: How to restrict web site/intranet access to company network? What is the best/most secure way to create a web site or intranet on an externally hosted server, but make it only accessible from

@Dunderdale272

Step 1: Require a Login

Add a login page in front of any content you don't want accessed externally. This will also help stop anybody visiting your office and using your WiFi from getting in. This is also a good idea even if you do host internally.

Step 2: Add an SSL

Add an SSL certificate so that you can load the site over HTTPS. This will stop any snoopers between your office and the webserver from reading what's going on.

Step 3: Block External Visitors

Use your .htaccess or nginx config to block IP addresses outside your company network. Anybody working remotely who still needs access should be able to do so via VPN.

Apache:

Order Deny,Allow
Deny from all
Allow from 1.2.3.4


nginx:

location / {
allow 1.2.3.4;
deny all;
}


Step 4: Set Noindex

Just in case any crawlers still manage to get past the IP block (which is easy enough to mess up or lose after a config update), tell them not to index your site.

Add <meta name="robots" content="noindex" /> into the HEAD of your pages, and return a X-Robots-Tag "noindex, nofollow" header.

nginx:

add_header X-Robots-Tag "noindex, nofollow";


PHP:

header("X-Robots-Tag: noindex", true);

Vote Up Vote Down