drupal disabling user login by .htaccess

description

If you are using drupal to server up a website but have no need for users on the public Internet to login to you site, then you can disable access to the login form or page. This will aid in preventing hackers from logging in as admin.

solution

Example: only allow access to user login from your private IP address range

Add the foilowing lines to the apache server definition in httpd.conf of other file where the site is defined.

<Location /user/login>
  Order allow,deny
  allow from 192.168.1.0/24
  allow from 127
</Location>

logs

By default, my apached logs the access attempt and errors as follows..

$ tail -f access_log error_log 
==> error_log <==
[Thu Sep 01 11:33:57 2016] [error] [client 188.72.99.71] client denied by server configuration: /var/www/example123.com/htdocs/user

==> access_log <==
188.72.99.71 188.72.99.71 - - [01/Sep/2016:11:33:57 -0500] "GET /user/login HTTP/1.1" 403 279