Restricting access through .htaccess, we allow access to only one ip, even if it doesn’t work out, how to implement it?

Question

htaccess

Hello.

I deny access to all but one IP address.
.htaccess

Order Deny,Allow
Deny from all
Allow from 100.00.00.00 I

forgot to write that the domain is via Cloudflare

. the site lets, what could be the problem?

Answer 1

When a site is proxied through Cloudflare, all requests go with Cloudflare's IP.
your solution is not good, the visitor can send his own X-Forwarded-For header and indicate his IP in it. And hack your site. Install mod_cloudflare
on your webserver and don't reinvent the wheel. PS: mod_cloudflare works only for the Web server, that is, ipfirewall / iptables will not work - they will get Cloudflare's IP.