@SDU if I don't (and can't) know the IP adresses that valid users are going to be using tomorrow (because they (or I) may be away from their base location, and still need to login) then I don't see how a .htaccess rule can determine who is a valid user. Having cloudflare or incapsula in between compounds this problem, as all ip addresses seen by htaccess are cloudflare/incapsula addresses not the originator addresses. (I know there is a module to get round this, but its not necessarily installed on all servers.) I have used .htaccess in the past where I did know in advance what addresses were valid.