Skip to content
BOA Documentation

Powered by Grav

Locking a whole site to your own IP addresses

Locking a whole site to your own IP addresses

This is the strongest of the access controls you can set up yourself. Instead of protecting just the admin pages, it makes an entire site reachable only from IP addresses you list. Everyone else — every page, not just the admin area — gets a "403 Forbidden". It's exactly what you want for a private intranet, a staging site you're not ready to show, or an admin-only tool.

(If you want the public site open to everyone and only the login/admin area restricted, that's the lighter login/admin IP lock instead.)

Setting it up

You set this up in a control file inside your own account:

TXT
static/control/ip/access.txt

On a typical account that's ~/static/control/ip/access.txt in your shell (the folder may not exist yet — just create it). Add one line per site: the site's name, then a space, then the IP addresses you want to let in, separated by spaces:

TXT
# static/control/ip/access.txt

intranet.example.com   203.0.113.10 203.0.113.0/24 2001:db8::/32
staging.example.com    198.51.100.42 2001:db8:1::1

A few things worth knowing as you fill this in:

  • Use each visitor's real public address — the one a site like https://ifconfig.co shows them, not a home/office LAN address like 192.168.x.x.
  • You can list IPv4 or IPv6 addresses, and either single addresses or whole ranges in CIDR notation (203.0.113.0/24, 2001:db8::/32), separated by spaces.
  • The lock covers the whole site, not just certain paths.
  • Lines starting with #, and blank lines, are ignored — so you can leave yourself notes.
  • If your sites sit behind Cloudflare, this still works on the visitor's real address — the platform recovers it for you — so enter the real client IP just the same.

You don't run anything or click Verify. The change is noticed on its own and takes effect within about two minutes.

You can't lock yourself out

This is the part that makes it safe to try. On top of whatever IPs you list, three addresses are always allowed, automatically, so a typo can never strand you or the site:

  • the loopback address (127.0.0.1),
  • the server's own address, and
  • any address currently connected over SSH — which includes you, right now, if you're working in your shell.

You never have to add those yourself, and you can't accidentally leave them out. Worst case, if you fat-finger an address and lock out the people you meant to let in, you fix the line and it corrects itself within a couple of minutes.

Opening the site back up

To lift the restriction, just delete that site's line from access.txt and save. On the next pass (again, within about two minutes) the site is open to everyone again. To remove all restrictions, empty the file or delete its lines. There's no separate "undo" step — removing the line is the undo.

© 2026 BOA Documentation. All rights reserved.