Can I prevent remote access to Umbraco back office? - umbraco

Question

We are running Umbraco 7.4. Due to a corporate security requirement, we need to prevent people from reaching oursite.com/umbraco from anywhere except the server itself as localhost/umbraco. I have tried an IIS rewrite for /umbraco#/ to no avail. I tried an IIS deny rule for /umbraco, but that actually broke some other stuff around our site. Is there some other awesome way to prevent remote access to the Umbraco back office?

Answer 1

I have done a similar thing with IIS rewrite rules where you can only access the back office from a specific set of domains (hence the wildcard matching). You could use this to only allow access from localhost. NOTE, place the rule in the umbraco folder, not the main site web.config. the full web.config contents to place in the umbraco folder is:
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<system.webServer>
<rewrite>
<rules>
<rule name="Umbraco only from localhost" enabled="true" patternSyntax="Wildcard"
stopProcessing="false">
<match url="*" negate="false" />
<action type="Rewrite" url="/UmbrSubDir404" appendQueryString="false"
logRewrittenUrl="false" />
<conditions logicalGrouping="MatchAll">
<add input="{HTTP_HOST}" pattern="localhost" negate="true" />
<add input="{URL}" pattern="*RestServices/ScheduledPublish*"
negate="true" />
<add input="{URL}" pattern="*umbraco/Api/*" negate="true" />
</conditions>
</rule>
</rules>
</rewrite>
</system.webServer>
</configuration>