This tutorial explains not only why site owners should or should not restrict user access to their sites, but how to properly manage users access if they choose to place restraints.

How to restrict visitor access to your web site

I will start this tutorial by telling you that it's wrong to restrict access to your visitors. Why would you want to do that?

Maybe you want to restrict certain users from accessing your web site...I recommend you to alter your database and just add a simple field to store the status in (1=active, 0=inactive). Should you ban a whole country because you target only regional traffic and they're eating your bandwith (hard to believe but...) ? Whatever the reason is (and if you're here in need for such tools please use the comments form and let us know your intention and also the motif that made you search for something like this) we will try to find out various ways of restricting a (or more?!:) visitor's access to your web site. I will start with a PHP solution that uses wildcards so you can ban a whole class just by replacing the desired class with an asterix "*" that will also be our wildcard.

//Wilcard character is an asterix, *
$ip_ban = array();
$ip_ban[] = "10.10.10.*"; // Bans 10.10.10.0 - 10.10.10.255
$ip_ban[] = "10.12.13.50"; // Bans 10.12.13.50
if(in_array($_SERVER['REMOTE_ADDR'],$ip_ban)) 
{
die("Your IP Address has been banned.");//Kill/stop the script and show message to user.
} 
else 
{
//Do loop through bans:
foreach($ip_ban as $ban) 
{
if(eregi($ban,$_SERVER['REMOTE_ADDR'])) 
{
die("Your IP Address has been banned."); //Kill/stop the script and show message to user.
}
//Finished loop
}
}

function ip_first($ips) {
if (($pos = strpos($ips, ',')) != false) {
return substr($ips, 0, $pos);
} else {
return $ips;
}
}
function ip_valid($ips) {
if (isset($ips)) {
$ip    = ip_first($ips);
$ipnum = ip2long($ip);
if ($ipnum !== -1 && $ipnum !== false && (long2ip($ipnum) === $ip)) { // PHP 4 and PHP 5
if (($ipnum < 167772160   || $ipnum >   184549375) && // Not in 10.0.0.0/8
($ipnum < -1408237568 || $ipnum > -1407188993) && // Not in 172.16.0.0/12
($ipnum < -1062731776 || $ipnum > -1062666241))   // Not in 192.168.0.0/16
return true;
}
}
return false;
}
function ip() {
$check = array('HTTP_X_FORWARDED_FOR', 'HTTP_X_FORWARDED',
'HTTP_FORWARDED_FOR', 'HTTP_FORWARDED',
'HTTP_VIA', 'HTTP_X_COMING_FROM', 'HTTP_COMING_FROM');
foreach ($check as $c) {
if (ip_valid(&$_SERVER[$c])) {
return ip_first($_SERVER[$c]);
}
}
return $_SERVER['REMOTE_ADDR'];
}

$check_visitor = "SELECT `visitor_ip` FROM `banned_visitors`";
$query_check_visitor = mysql_query($check_visitor) or die(mysql_error());

                          
$ip_ban = array();
while ($row=mysql_fetch_array($query_check_visitor))
{
$ip_ban[] = $row['visitor_ip'];
}
if(in_array(ip(),$ip_ban))
{
die("Your access was restricted on this server.");
}
else
{
foreach($ip_ban as $ip)
{
if(eregi($ip,ip())) die("Your access was restricted on this server.");
}

	}

<limit GET> 
order deny,allow 
deny from all 
allow from 192.168
</limit>

<limit GET> 
order allow,deny
allow from all 
deny from 192.168
</limit>

<limit GET> 
order deny,allow 
deny from all 
allow from 127.0.0.1
</limit>

	if(isset($_SESSION['failed_logins'])) 
{
$_SESSION['failed_logins']++;
} 
else 
{
$_SESSION['failed_logins'] = 1;
}