Make a Website Only Accessible to You, Redirect Everyone Else

Can You Restrict Access to a Website Without a Password?

Yes, you can. Let me show you how with a little .htaccess magic.

Note: If you use this, I highly suggest using the one below, where you redirect people to a page on your website instead of a Forbidden message. I had Chrome label a site as “Dangerous” and I suspect that was because I was seeing something different with my IP than what they saw, so I’m guessing they thought there was malware or something.

I’ve been doing some development lately, and I’ve had a few domains that were new or were not being used, and I wanted to develop the site in the live area, but I didn’t want anyone to see the site but me. This is handy because you don’t have to move things later from development to live. Yes, if you’re using WordPress, you can use a “maintenance mode” type plugin, but that can sometimes get messy, too.

So here’s some .htaccess magic to make that happen. It’s pretty simple. You just need to know your IP address and then be able to edit the .htaccess file in your website root (or create that text file if it doesn’t exist – I usually upload it as htaccess.txt and then rename it to .htaccess once it’s uploaded to make things easier).

Here’s what you put in:

# Staging On/Off - Used during development
RewriteCond %{HTTP_HOST} ^yourdomain\.com$ [NC]

# Exclude my IP addresses
RewriteCond %{REMOTE_ADDR} !^123\.456\.789\.012$
RewriteCond %{REMOTE_ADDR} !^123\.456\.789\.013$

# Redirect everyone else
RewriteRule ^(.*)$ https://www.someotherwebsite.com/ [R=302,L]

It’s pretty simple. Put your domain where it shows the domain (yourdomain.com in this example).

In the next section, you say which IPs should see the website. I’m using these two, fake IP addresses as example:

• 123.456.789.012
• 123.456.789.013

You need to separate them with the slashes. If you don’t have 2, then just remove one line – or add as many lines as you need in that section.

The last section is a 302 (temporary) redirect to wherever you want people to go. It can’t be the same domain, of course.

Redirect to a Coming Soon Page Using .htaccess

Here’s .htaccess code to redirect people to a coming soon page while allowing your IP addresses (or whatever IP addresses you choose) to get access.

# Staging On/Off - Used during development
RewriteCond %{HTTP_HOST} ^yourdomain\.com$ [NC]

# Exclude your IP addresses
RewriteCond %{REMOTE_ADDR} !^123\.456\.789\.012$
RewriteCond %{REMOTE_ADDR} !^123\.456\.789\.013$

# Exclude the coming soon page to prevent a redirect loop
RewriteCond %{REQUEST_URI} !^/coming-soon\.html$

# Redirect everyone else to the coming soon page
RewriteRule ^(.*)$ /coming-soon.html [R=302,L]

Another Version That Asks for a Password

Here’s another one that checks to see if the website visitor’s IP is on the list, but if not, it asks for a password. You’ll use this in conjunction with .htpasswd. See my .htpasswd generator tool if you need help with that.

AuthType Basic
AuthName "Restricted Access"
AuthUserFile /full/path/to/.htpasswd
Require valid-user

# Allow access without password for these IPs
SetEnvIf Remote_Addr "^134\.215\.120\.122$" allow_ip
SetEnvIf Remote_Addr "^111\.222\.333\.444$" allow_ip

Order allow,deny
Allow from env=allow_ip
Satisfy any

Coming Soon Page Using .htaccess for WordPress

If you’re using WordPress and want a Coming Soon page without using a plugin, you can use this:

# BEGIN Coming Soon Redirect
RewriteEngine On

# Allow your IP(s) to access the full site
RewriteCond %{REMOTE_ADDR} !^123\.456\.789\.012$
RewriteCond %{REMOTE_ADDR} !^123\.456\.789\.013$

# Prevent redirect loop and allow WordPress admin, login, and AJAX
RewriteCond %{REQUEST_URI} !^/coming-soon/?$
RewriteCond %{REQUEST_URI} !^/wp-login\.php$
RewriteCond %{REQUEST_URI} !^/wp-admin
RewriteCond %{REQUEST_URI} !^/wp-json
RewriteCond %{REQUEST_URI} !^/wp-admin/admin-ajax\.php$

# Redirect everyone else to the Coming Soon page
RewriteRule ^.*$ /coming-soon/ [R=302,L]
# END Coming Soon Redirect

Additional Setup Notes:

• Create the page: In WordPress, create a page with the slug /coming-soon/ and publish it.
• Don’t use plugins that override .htaccess (like some security or caching plugins) without checking compatibility.
• You can change the [R=302,L] to [R=301,L] for a permanent redirect once everything is ready—but while testing, stick with 302.

If you need help getting someone’s IP address (or your own), just go to CopyMyIP.dev.

Conclusion

And this is assuming you have a static IP address. Even if you didn’t, you could check your IP address, then change the settings in the file each time you get on the internet.

This will work for non-WordPress sites, too – any website using an Apache web server. I have more htaccess tricks if you’re interested.

📄 Download a PDF of This Article