Protect Yourls Login Page with Apache/.htaccess

For those who know, YOURLS makes it super easy to host your own URL shortening service. I use Yourls on several sites and it works great at generating shortlinks for otherwise long and tedious URLs. So they’re easier to share, remember, social media, etc. Yourls is developed by a well-respected developer and is 100% FREE and open source for everyone. It’s a truly great app and highly recommended.

Contents

• Protect Yourls Login on Apache > 2.4
• Protect Yourls Login on older versions of Apache
• Bonus: Combo Pack for all versions of Apache
• Allowing access to multiple IP addresses
• Learn more..

Protect Yourls Login on Apache > 2.4

I’ve used Yourls for many years and it just works (perfectly, I might add). The only headache I’ve encountered, which really isn’t a big deal if you’re using super strong passwords, is that attackers will target the Yourls login page all day long. As soon as teh kids find out about it, they will run endless brute-force and slow-drip password attacks non-stop 24-7 until the cows come home.

Lock ’em down

So to lock things down and block all the login/password attempts, here is a quick snippet of Apache/.htaccess that you can add directly to your Yourls /admin/ folder:

<Files index.php>
	<IfModule authz_core_module>
		Require ip 123.123.123.123
	</IfModule>
</Files>

By default, the Yourls /admin/ folder does not include an .htaccess file. So you will need to create/add one, here is a quick guide. After adding a blank/empty .htaccess file, add the above code snippet. Also make sure to edit the IP address to match your own. Save changes, upload, test well, and done.

This security technique is an example of why I heart Apache/.htaccess. It’s just so simple, easy, and very effective. After adding the above code, the endless login requests and password stabs are completely blocked, while Yourls continues to function flawlessly for all of your shortened URLs. But only you will have access to the login page, based on the provided IP address.

Protect Yourls Login on older versions of Apache

The previous code snippet requires Apache version 2.4 or better. For older versions of Apache, use this code instead:

<Files index.php>
	<IfModule !authz_core_module>
		Order Deny,Allow
		Deny from all
		Allow from 123.123.123.123
	</IfModule>
</Files>

Same steps as before, and again, remember to edit the IP address and test well before going live.

Bonus: Combo Pack for all versions of Apache

If you are not sure about which version of Apache you are running, and/or just want something that will work in any Apache environment, use this code snippet:

<Files index.php>
	<IfModule authz_core_module>
		Require ip 123.123.123.123
	</IfModule>
	<IfModule !authz_core_module>
		Order Deny,Allow
		Deny from all
		Allow from 123.123.123.123
	</IfModule>
</Files>

Same steps as before, and again, remember to edit the IP addresses (both instances) and test well before going live. Also, to learn more about this technique, check out my post, Access Control for Apache 2.4 (and 2.2).

Allowing access to multiple IP addresses

To allow access to the Yourls login page for multiple IP addresses, simply add as many Require directives as is required. So for example, if you want to allow access for three different IP addresses, do this for Apache 2.4 and better:

<Files index.php>
	<IfModule authz_core_module>
		Require ip 123.123.123.123
		Require ip 111.222.333.120
		Require ip 112.223.331.012
	</IfModule>
</Files>

As many as you want. And here is the code for older versions of Apache:

<Files index.php>
	<IfModule !authz_core_module>
		Order Deny,Allow
		Deny from all
		Allow from 123.123.123.123
		Allow from 111.222.333.120
		Allow from 112.223.331.012
	</IfModule>
</Files>

Bada bing, bada boom.

Learn more..

For more Apache/.htaccess and security techniques check out my other articles in these fine locations:

• Posts tagged with Apache
• Posts categorized as .htaccess
• Posts categorized as security
• Apache/.htaccess code snippets
• Check out my book, .htaccess made easy

About the Author

Jeff Starr = Web Developer. Book Author. Secretly Important.