Access Control

Apache 2.4 controls who can reach a resource with the Require directive. This replaced the older Order, Allow, and Deny syntax from version 2.2.

Allow Everyone

<Directory /var/www/html>
    Require all granted
</Directory>

Deny Everyone

<Directory /var/www/private>
    Require all denied
</Directory>

Restrict by IP Address

Allow only a single address or a whole network:

<Directory /var/www/admin>
    Require ip 192.168.1.0/24
</Directory>

Combine Multiple Rules

Use RequireAll or RequireAny to group conditions:

<Directory /var/www/admin>
    <RequireAny>
        Require ip 10.0.0.5
        Require ip 192.168.1.0/24
    </RequireAny>
</Directory>

RequireAny grants access if at least one condition matches; RequireAll requires every condition to match.

Apply Changes

sudo apache2ctl configtest
sudo systemctl reload apache2

Access control by IP is a simple first layer; for real protection of accounts, combine it with authentication.