. Htaccess User Guide-how to use access IP Control

Create a file named ". htaccess" in the directory where you want to disable the column directory, and use the Allow and Deny options.

Allow and Deny can be used in apache conf Files or. htaccess Files (with Directory, Location, Files, etc.) to control access authorization for directories and Files.

Therefore, the most common ones are:
Order Deny, Allow
Allow from All

Note that "Deny, Allow" has only one comma in the middle and only one comma in the middle. If there are spaces, errors will occur. Words are case-insensitive. The meaning of the above setting is to first set "Check prohibition settings first, not all permitted", and the second sentence does not contain Deny, that is, no access prohibition settings, allow all access. This is mainly used to ensure or overwrite the settings of the upper-level directory and open access to all content.

According to the above explanation, the following settings prohibit access unconditionally:
Order Allow, Deny
Deny from All

If you want to disable access to part of the content, all others are open:
Order Deny, Allow
Deny from ip1 ip2
Or
Order Allow, Deny
Allow from all
Deny from ip1 ip2

Apache determines which rule will be used according to order. For example, in the second method above, although allow in the second sentence allows access, because allow in order is not the final rule, therefore, you need to check whether there are any deny rules. Therefore, in the third sentence, access that complies with ip1 and ip2. Note that the "last" rule determined by order is very important. The following are two examples of errors and the correct method:

Order Deny, Allow
Allow from all
Deny from domain.org
Error: If you want to disable access from domain.org, but deny is not the final rule, apache has successfully matched the second allow sentence and won't go to the third sentence.
Solution: Order Allow, Deny. You can leave the last two sentences unchanged.

Order Allow, Deny
Allow from ip1
Deny from all
Error: I want to only allow access from ip1. However, although the allow rule is set in the second sentence, because the deny in order is after, the deny in the third sentence prevails, however, the scope of the third sentence obviously contains ip1 (all include ip1), so all accesses are forbidden.
Solution 1: remove the third sentence directly.
Solution 2:
Order Deny, Allow
Deny from all
Allow from ip1

The following is an example of a test:
--------------------------------
Order deny, allow
Allow from all
Deny from 219.204.253.8
# All are accessible
-------------------------------
Order deny, allow
Deny from 219.204.253.8
Allow from all
# All are accessible
-------------------------------
Order allow, deny
Deny from 219.204.253.8
Allow from all
# Only 219.204.253.8 is inaccessible
-------------------------------
Order allow, deny
Allow from all
Deny from 219.204.253.8
# Only 219.204.253.8 is inaccessible
-------------------------------
-------------------------------
Order allow, deny
Deny from all
Allow from 219.204.253.8
# All cannot pass
-------------------------------
Order allow, deny
Allow from 219.204.253.8
Deny from all
# All cannot pass
-------------------------------
Order deny, allow
Allow from 219.204.253.8
Deny from all
# Only 219.204.253.8 traffic is allowed
-------------------------------
Order deny, allow
Deny from all
Allow from 219.204.253.8
# Only 219.204.253.8 traffic is allowed
-------------------------------
--------------------------------
Order deny, allow
# All are accessible (default)
-------------------------------
Order allow, deny
# All cannot pass (default)
-------------------------------
Order allow, deny
Deny from all
# All cannot pass
-------------------------------
Order deny, allow
Deny from all
# All cannot pass
-------------------------------
In the above two cases, if you change to allow from all, all traffic will be available!
-------------------------------
Order deny, allow
Deny from 219.204.253.8
# Only 219.204.253.8 is inaccessible
-------------------------------
Order allow, deny
Deny from 219.204.253.8
# All cannot pass
-------------------------------
Order allow, deny
Allow from 219.204.253.8
# Only 219.204.253.8 traffic is allowed
-------------------------------
Order deny, allow
Allow from 219.204.253.8
# All are accessible
-------------------------------
-------------------------------
Order deny, allow
Allow from 218.0000253.2
Deny from 218.20
# Deny the IP address starting with 218.20, but allow 218.255.253.2 to pass. Other IP addresses not starting with 218 can also pass.
-------------------------------
Order allow, deny
Allow from 218.0000253.2
Deny from 218.20
# It is similar to the above, except that the allow and deny orders in the order statement for replacement are dropped, but the final result indicates that all statements are rejected!