# Mautic Security & Limiting Access **URL:** \ **Category:** Product Support\ **Created:** [April 27, 2016, 5:24pm UTC](https://forum.mautic.org/t/mautic-security-limiting-access/3615 "2016-04-27T17:24:18Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![mhal](https://avatars.discourse-cdn.com/v4/letter/m/e79b87/32.png) [@mhal](https://forum.mautic.org/u/mhal)\ **Post date:** [April 27, 2016, 5:24pm UTC](https://forum.mautic.org/t/mautic-security-limiting-access/3615/1 "2016-04-27T17:24:18Z")
Hey everyone! I am looking for documentation on how best to secure Mautic from outside access. I am unable to find any decent documentation on how best to secure the Mautic installation. **I feel like having an article on this topic would be extremely beneficial to the Mautic community.** I’d like to lock down the ability to login to Mautic. In WordPress land, there are plugins like “Login Lockdown” that will limit login attempts at the software level - after X number of login failures, the software will actually block that IP address. I am looking to do something similar with Mautic, maybe even limit logins by IP address. But with this added security, whatever I do, I want to make sure the tracking pixel, email assets, and landing pages are still accessible. I’d really only like to limit access to the login at: [domain.com/s/login](http://domain.com/s/login) I am running on a LEMP stack - I’d prefer not to lock things down at that level. It makes the most sense to lock login access down at the Mautic software level. In my particular Mautic installation, only company employees will be logging into Mautic. I see that Mautic has the ability to allow customers to update their information, but that is not something we will be doing. I really appreciate anyone who can help me better understand how to secure Mautic. ---
**Author:** ![mhal](https://avatars.discourse-cdn.com/v4/letter/m/e79b87/32.png) [@mhal](https://forum.mautic.org/u/mhal)\ **Post date:** [April 27, 2016, 5:24pm UTC](https://forum.mautic.org/t/mautic-security-limiting-access/3615/2 "2016-04-27T17:24:18Z")
Hey everyone! I am looking for documentation on how best to secure Mautic from outside access. I am unable to find any decent documentation on how best to secure the Mautic installation. I feel like having an article on this topic would be extremely beneficial to the Mautic community. I’d like to lock down the ability to login to Mautic. In WordPress land, there are plugins like “Login Lockdown” that will limit login attempts at the software level - after X number of login failures, the software will actually block that IP address. I am looking to do something similar with Mautic, maybe even limit logins by IP address. But with this added security, whatever I do, I want to make sure the tracking pixel, email assets, and landing pages are still accessible. I’d really only like to limit access to the login at: [domain.com/s/login](http://domain.com/s/login) I am running on a LEMP stack - I’d prefer not to lock things down at that level. It makes the most sense to lock login access down at the Mautic software level. In my particular Mautic installation, only company employees will be logging into Mautic. I see that Mautic has the ability to allow customers to update their information, but that is not something we will be doing. I really appreciate anyone who can help me better understand how to secure Mautic. ---
**Author:** ![mhal](https://avatars.discourse-cdn.com/v4/letter/m/e79b87/32.png) [@mhal](https://forum.mautic.org/u/mhal)\ **Post date:** [April 27, 2016, 7:02pm UTC](https://forum.mautic.org/t/mautic-security-limiting-access/3615/3 "2016-04-27T19:02:24Z")
Thanks for the quick reply, @MxyzptlkFishStix. I was leaning on a server level block/whitelist and I think that’s what I’ll do. On a side note, what files would/should I include on the whitelist? I know the /s/login page - but are there other files and directories that should be included as well? The Mautic documentation on the security end is very sparse, at least from what I have been able to find. If you have a URL that I should read, please send it my way. Thanks again!!! ---
**Author:** ![raleigh](https://avatars.discourse-cdn.com/v4/letter/r/ea666f/32.png) [@raleigh](https://forum.mautic.org/u/raleigh)\ **Post date:** [November 4, 2016, 4:52am UTC](https://forum.mautic.org/t/mautic-security-limiting-access/3615/4 "2016-11-04T04:52:31Z")
Hi, may I join as I have the same concern, how to secure Mautic installation? Aside from having SSL on the site, does restricting to limited authorized IPs affects the data gathering from channels like email tracking? Tried already to restrict from htaccess but noticed that the Email Read statistics became zero. Thanks a lot in advance. ---
**Author:** ![swip](https://avatars.discourse-cdn.com/v4/letter/s/f475e1/32.png) [@swip](https://forum.mautic.org/u/swip)\ **Post date:** [November 4, 2016, 2:48pm UTC](https://forum.mautic.org/t/mautic-security-limiting-access/3615/5 "2016-11-04T14:48:55Z")
[quote=17000:@raleigh]Hi, may I join as I have the same concern, how to secure Mautic installation? Aside from having SSL on the site, does restricting to limited authorized IPs affects the data gathering from channels like email tracking? Tried already to restrict from htaccess but noticed that the Email Read statistics became zero. Thanks a lot in advance.[/quote] .htaccess rules cover the entire directory, don’t use them to secure or you’ll also lose access for people clicking on landing pages, tracking pixel etc. SSL will only encrypt data transmission, it won’t protect you from brute force logins. Limiting access to sensitive pages like the login page, dashboard, etc. by IP is the way to go. ---
**Author:** ![ninjoan](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/ninjoan/32/1005_2.png) [@ninjoan](https://forum.mautic.org/u/ninjoan)\ **Post date:** [November 4, 2016, 4:15pm UTC](https://forum.mautic.org/t/mautic-security-limiting-access/3615/6 "2016-11-04T16:15:04Z")
interesting i have on workaround solution that im testing… ---
**Author:** ![jcschile](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/jcschile/32/129_2.png) [@jcschile](https://forum.mautic.org/u/jcschile)\ **Post date:** [January 21, 2017, 2:58am UTC](https://forum.mautic.org/t/mautic-security-limiting-access/3615/7 "2017-01-21T02:58:48Z")
@ninjoan any news?? I have tried .htaccess but it didn’t work. And I couldn’t implement what @MxyzptlkFishStix suggested ---
**Author:** ![denispavliha](https://avatars.discourse-cdn.com/v4/letter/d/e0b2c6/32.png) [@denispavliha](https://forum.mautic.org/u/denispavliha)\ **Post date:** [January 21, 2017, 5:08pm UTC](https://forum.mautic.org/t/mautic-security-limiting-access/3615/8 "2017-01-21T17:08:56Z")
I am also securing the email previews, since they are not part of /s/ URL and can, thus, be accessed even when not logged in. ` AllowOverride All Order Allow,Deny Allow from SOME_TRUSTED_IP ` Best, D ---
**Author:** ![dlor](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/dlor/32/627_2.png) [@dlor](https://forum.mautic.org/u/dlor)\ **Post date:** [May 4, 2021, 8:11am UTC](https://forum.mautic.org/t/mautic-security-limiting-access/3615/9 "2021-05-04T08:11:53Z")
Hi, Can you share your solution ? Did you modify your apache conf or your .htaccess ? Thanks ---
**Author:** ![alejandroortega](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/alejandroortega/32/6445_2.png) [@alejandroortega](https://forum.mautic.org/u/alejandroortega)\ **Post date:** [December 10, 2021, 4:57pm UTC](https://forum.mautic.org/t/mautic-security-limiting-access/3615/10 "2021-12-10T16:57:40Z")
Hi folks Do you know if is coming a brute force attack plugin or something that prevents massive attemps to login page. Restrict the login page whit certain IP range is not an option for me. Thank you! Regards