Locking the login and admin area to your own IP addresses

Sometimes you want the public site open to everyone, but the login and admin pages (/user and /admin) reachable only from your own connections — to keep bots and strangers away from the back office without hiding the site itself. That's this control.

It works exactly like the whole-site IP lock, but it only guards /user and /admin (and the pages under them); everything else stays public. Anyone else who opens /user or /admin gets a plain "403 Forbidden".

Setting it up

Edit (or create) this control file in your own account:

static/control/ip/user_admin.txt

On a typical account that's ~/static/control/ip/user_admin.txt in your shell (the folder may not exist yet — just create it). Add one line per site: the site's name, then the addresses allowed to reach /user and /admin:

# static/control/ip/user_admin.txt

intranet.example.com   203.0.113.10 203.0.113.0/24 2001:db8::/32
staging.example.com    198.51.100.42 2001:db8:1::1

As with the whole-site lock:

• you can list IPv4 or IPv6 addresses, single or as CIDR ranges, separated by spaces;
• use each visitor's real public address — the one a site like https://ifconfig.co shows them, not a home/office LAN address like 192.168.x.x (and behind Cloudflare the platform recovers the real address for you, so enter it just the same);
• lines starting with #, and blank lines, are ignored — leave yourself notes freely.

You don't run anything or click Verify. The change takes effect within about two minutes.

The same safety nets apply

• Your own address is always allowed — the loopback address, the server itself, and any address currently connected over SSH (which includes you, right now, if you're working in your shell) — so you can't lock yourself out of the admin area.
• Deleting a site's line lifts the restriction on the next pass; there's no separate undo step.

You can use this together with the whole-site lock or on its own.

Related pages

• Restricting access to your site — the overview of all the access controls, including the default admin-page protection.
• Site IP lock — the stronger variant: the whole site answers only to your listed addresses.
• AI crawlers and assistants — deciding which AI bots may read each site, from the same kind of control file.
• Shell and SFTP access — how to connect so you can edit user_admin.txt in the first place.