PHPackages                             sourcebroker/restrictfe - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. sourcebroker/restrictfe

ActiveTypo3-cms-extension

sourcebroker/restrictfe
=======================

This extension blocks access to frontend and allows to show it only to some defined exception's like if the request is from an authorized backend user, has specific IP, header, domain, language or GET/POST vars. Useful to protect your staging and production instances.

12.0.1(11mo ago)1256.9k↓30.3%3GPL-2.0-or-laterPHPPHP >=7.4

Since Jan 27Pushed 11mo ago2 watchersCompare

[ Source](https://github.com/sourcebroker/restrictfe)[ Packagist](https://packagist.org/packages/sourcebroker/restrictfe)[ RSS](/packages/sourcebroker-restrictfe/feed)WikiDiscussions master Synced 1mo ago

READMEChangelogDependencies (2)Versions (36)Used By (0)

TYPO3 Extension `restrictfe`
============================

[](#typo3-extension-restrictfe)

> [![https://poser.pugx.org/sourcebroker/restrictfe/d/monthly](https://camo.githubusercontent.com/867cd6b2326ab1e6a71261d394f29e588d1ad242b8553bbd36b20317ebebaf1b/68747470733a2f2f706f7365722e707567782e6f72672f736f7572636562726f6b65722f726573747269637466652f642f6d6f6e74686c79)](https://packagist.org/packages/sourcebroker/restrictfe)[![https://poser.pugx.org/sourcebroker/restrictfe/v/stable](https://camo.githubusercontent.com/7f6a16a72188a42cf1d49c5ef8dac11ed0ba893359b7ee09f7f52f5f47647e1d/68747470733a2f2f706f7365722e707567782e6f72672f736f7572636562726f6b65722f726573747269637466652f762f737461626c65)](https://packagist.org/packages/sourcebroker/restrictfe)[![https://poser.pugx.org/sourcebroker/restrictfe/license](https://camo.githubusercontent.com/3bc24b4de235169e421bcc0311073f70a4e029aeae60ba2fbd9e0c948af633d2/68747470733a2f2f706f7365722e707567782e6f72672f736f7572636562726f6b65722f726573747269637466652f6c6963656e7365)](https://packagist.org/packages/sourcebroker/restrictfe)

- [What does it do?](#what-does-it-do)
- [How this can be useful for me?](#how-this-can-be-useful-for-me)
- [Installation](#installation)
- [Documentation](#documentation)
    - [Exceptions](#exceptions)
    - [Conditions](#conditions)
        - [backendUser](#backenduser)
        - [domain](#domain)
        - [get](#get)
        - [header](#header)
        - [ip](#ip)
        - [post](#post)
        - [requestUri](#requesturi)
- [Configuration examples](#configuration-examples)
    - [Production instance that must have language /fr/ not available public](#production-instance-that-must-have-language-fr-not-available-public)
    - [Production instance that must have domain "sub.example.com" not avaliable public](#production-instance-that-must-have-domain-sub-example-com-not-avaliable-public)
    - [Staging instance that needs to unblock frontend for Google Page Speed Insights](#staging-instance-that-needs-to-unblock-frontend-for-google-page-speed-insights)
    - [Staging instance that needs to unblock frontend for IP=11.11.11.11](#staging-instance-that-needs-to-unblock-frontend-for-ip-11-11-11-11)
    - [Example how the AND condition looks like](#example-how-the-and-condition-looks-like)
    - [Default Configuration](#default-configuration)
- [FAQ](#faq)
- [Known problems](#known-problems)
- [To-Do list](#to-do-list)
- [Changelog](#changelog)

[What does it do?](#id1)
------------------------

[](#what-does-it-do)

This extension blocks access to frontend and allows to show it only to some defined exception's like if the request is from an authorized backend user, has specific IP, header, domain, language or GET/POST vars. Useful to protect your staging and production instances.

[How this can be useful for me?](#id2)
--------------------------------------

[](#how-this-can-be-useful-for-me)

It will be useful whenever you want to protect whole or part of website from being public. See following examples for staging and production instances.

**For staging instances**

You will find restrictfe useful if you have staging instances and you want to protect frontend content form public but at the same time:

- allow to show frontend to authorized backend users,
- allow to show frontend to IP of your VPN,
- allow to show frontend to your external spiders for crawling,
- allow some payment systems to send confirm link to your application endpoint,
- allow Google Page Speed to make tests,
- etc.

**For production instances**

You will find restrictfe useful if you have production instance which is already live but access to some part of website must be yet hidden for regular frontend users. At the same time is must be accessible in frontend for logged backend users which must be able to edit content on that hidden part.

[Installation](#id3)
--------------------

[](#installation)

Just use composer or download by Extension Manager.

```
composer require sourcebroker/restrictfe
```

Be aware that after installation restrictfe blocks all traffic to frontend by default. This is by design because if you will add new staging instances they will be blocked by default so there is no risk that you forgot to protect it and someone will see new staging instance or google will index it. Of course you must remember to unblock production instance with simple line:

```
$GLOBALS['TYPO3_CONF_VARS']['EXTCONF']['restrictfe']['exceptions'] = ['*' => true];
```

Put this config in the file that is included only on live instance!

**Notice!**restrictfe protection is not working if $\_SERVER\['REMOTE\_ADDR'\] == 127.0.0.1 so if you are working on your local instance restrictfe is disabled. If you want to to make testing and enable it on your local instance insert following line in typo3conf/AdditionalConfiguration.php or in some extension ext\_localconf.php: `$GLOBALS['TYPO3_CONF_VARS']['EXTCONF']['restrictfe']['exceptions']['ip'] = '__UNSET';`

[Documentation](#id4)
---------------------

[](#documentation)

### [Exceptions](#id5)

[](#exceptions)

As stated earlier restrictfe blocks all traffic to frontend and we must set exceptions that will allow to see the frontend. Those exceptions conditions are written in `$GLOBALS['TYPO3_CONF_VARS']['EXTCONF']['restrictfe']['exceptions']`array. By default on first level conditions are joined with logical OR but you can join them with AND if you will make AND array key and conditions inside. You can nest OR/AND conditions inside arrays. Values of conditions can be string or array. If its array its OR'ed. Some conditions can be negated. In such case the conditions inside are AND'ed.

**The result of this condition checks is used to decide if frontend should be blocked or not. If its true then frontend is not blocked.**

### [Conditions](#id6)

[](#conditions)

#### [backendUser](#id7)

[](#backenduser)

- *Argument*

    Activate (boolean)
- *Note*

    - If activated then frontend will be visible to authorized backend users. Only single authorization is needed and user can log out because special cookie will allow him to see frontend. That also means that BE user can unlog from backend and still see the frontend - its crucial for good testing of caching bugs.
    - For backend user you can check “Clear BE session after login” in backend user record. This will unlog BE user from backend just after authorization. This is useful if you want to create only kind of "preview" BE user. This user does not need to have access to any BE module and do not needs rights to read/write any table.
    - As stated in last points after backend user authorization special cookie is set that allows to access frontend even after backend user will be logged off. You can set each aspect of this cookie by setting `$GLOBALS['TYPO3_CONF_VARS']['EXTCONF']['restrictfe']['cookie']`array. For example you can set the cookie for multiple subdomains which means that user needs to authorize only once to have access to all protected subdomains. With htaccess password user would need to authorize to each subdomain independently. Example: `$GLOBALS['TYPO3_CONF_VARS']['EXTCONF']['restrictfe']['cookie']['domain'] = '.example.com';`
- *Example*

    ```
    $GLOBALS['TYPO3_CONF_VARS']['EXTCONF']['restrictfe']['exceptions'] = [
        backendUser' => true
    ];
    ```

#### [domain](#id8)

[](#domain)

- *Argument*

    Domain name (string)
- *Note*

    You can negate this condition with !domain.
- *Example*

    Allow frontend access to all except traffic to domain sub.example.com

    ```
    $GLOBALS['TYPO3_CONF_VARS']['EXTCONF']['restrictfe']['exceptions'] = [
       '!domain' => ['sub.example.com']
    ];
    ```

#### [get](#id9)

[](#get)

- *Argument*

    "getName=getValue" pairs (string)
- *Note*

    You can negate this condition with !get.
- *Example*

    Allow only request with GET param secret=999 to access frontend.

    ```
    $GLOBALS['TYPO3_CONF_VARS']['EXTCONF']['restrictfe']['exceptions'] = [
     'get' => 'secret=999'
    ];
    ```

#### [header](#id10)

[](#header)

- *Argument*

    "headerName=headerValue" pairs (string)
- *Note*

    You can negate this condition with !header.
- *Example*

    Allow only request with HTTP header MYHEADER=99 to access frontend.

    ```
    $GLOBALS['TYPO3_CONF_VARS']['EXTCONF']['restrictfe']['exceptions'] = [
       'header' => 'MYHEADER=99'
    ];
    ```

#### [ip](#id11)

[](#ip)

- *Argument*

    Single IP with mask (string), comma separated list of IPs with mask(string), array of IPs with mask (array string)
- *Note*

    In the background a `GeneralUtility::cmpIP()` is used so you can use * and mask for IP like 12.12.45.* or 13.55.0.0/16.

    You can negate this condition with !ip.
- *Example*

    Allow frontend access only for IP 11.11.11.11 or 22.22.22.22 or 33.33.33.33

    ```
    $GLOBALS['TYPO3_CONF_VARS']['EXTCONF']['restrictfe']['exceptions'] = [
      'ip' => [
             '11.11.11.11',  // ip of developers VPN
             '22.22.22.22'   // ip of client VPN
             '33.33.33.33'   // payment system confirm request
           ]
      ];
    ```

    Block frontend access to traffic from IP range 34.34.0.0/16

    ```
    $GLOBALS['TYPO3_CONF_VARS']['EXTCONF']['restrictfe']['exceptions'] = [
        '!ip' => [
            '34.34.0.0/16', // some not trusted network
        ]
    ];
    ```

#### [post](#id12)

[](#post)

- *Argument*

    "getName=getValue" pairs (string)
- *Note*

    You can negate this condition with !post.
- *Example*

    Allow only request with POST param secret=999 to access frontend.

    ```
    $GLOBALS['TYPO3_CONF_VARS']['EXTCONF']['restrictfe']['exceptions'] = [
       'post' => 'secret=999'
    ];
    ```

#### [requestUri](#id13)

[](#requesturi)

- *Argument*

    uri part after domain without leading slash (string)
- *Note*

    You can negate this condition with !requestUri. The argument is search for only on begining of text.
- *Example*

    Allow only request starting with api/ to be processed.

    ```
    $GLOBALS['TYPO3_CONF_VARS']['EXTCONF']['restrictfe']['exceptions'] = [
       'requestUri' => ['api/', 'api2/']
    ];
    ```

[Configuration examples](#id14)
-------------------------------

[](#configuration-examples)

Some most useful real live configuration examples:

### [Production instance that must have language /fr/ not available public](#id15)

[](#production-instance-that-must-have-language-fr-not-available-public)

```
$GLOBALS['TYPO3_CONF_VARS']['EXTCONF']['restrictfe']['exceptions'] = [
        '!requestUri' => 'fr/',
];
```

### [Production instance that must have domain "sub.example.com" not avaliable public](#id16)

[](#production-instance-that-must-have-domain-subexamplecom-not-avaliable-public)

```
$GLOBALS['TYPO3_CONF_VARS']['EXTCONF']['restrictfe']['exceptions'] = [
        '!domain' => 'sub.example.com',
];
```

### [Staging instance that needs to unblock frontend for Google Page Speed Insights](#id17)

[](#staging-instance-that-needs-to-unblock-frontend-for-google-page-speed-insights)

```
$GLOBALS['TYPO3_CONF_VARS']['EXTCONF']['restrictfe']['exceptions'] = [
       'get' => 'secret=91009123',
];
```

Then of course the url you give google for testing is:

### [Staging instance that needs to unblock frontend for IP=11.11.11.11](#id18)

[](#staging-instance-that-needs-to-unblock-frontend-for-ip11111111)

```
$GLOBALS['TYPO3_CONF_VARS']['EXTCONF']['restrictfe']['exceptions'] = [
      'ip' => '11.11.11.11',
];
```

### [Example how the AND condition looks like](#id19)

[](#example-how-the-and-condition-looks-like)

ip and header are AND'ed. array values inside ip and header are OR'ed.

```
$GLOBALS['TYPO3_CONF_VARS']['EXTCONF']['restrictfe']['exceptions'] = [
        'AND' => [
             'ip' => [
                '66.249.64.0/19'
                '66.249.44.0/19'
                ],
             'header' => [
                'HTTP_USER_AGENT=Google Page Speed Insights'
                'HTTP_USER_AGENT=Google Page Speed'
               ],
             ]
        ]
];
```

### [Default Configuration](#id20)

[](#default-configuration)

By default following configuration is applied. You can change every element of this array using `$GLOBALS['TYPO3_CONF_VARS']['EXTCONF']['restrictfe']`

```
[
  'templatePath' => ExtensionManagementUtility::siteRelPath('restrictfe').'Resources/Private/Templates/Restricted.html',
  'cookie'       => [
      'expire'   => time() + 86400 * 30,
      'path'     => '/',
      'domain'   => null,
      'secure' => ((int)$GLOBALS['TYPO3_CONF_VARS']['SYS']['cookieSecure'] === 1 || GeneralUtility::getIndpEnv('TYPO3_SSL')),
      'httponly' => $GLOBALS['TYPO3_CONF_VARS']['SYS']['cookieHttpOnly'],
  ],
  'exceptions' => [
      'backendUser' => true,
      'ip'          => '127.0.0.1',
  ],
];
```

[FAQ](#id21)
------------

[](#faq)

- **Extension does not work. The frontend is not blocked at all. What is wrong?**Be sure you are logged from BE and the cookie "restrictfe" is deleted. Remember also that restrictfe protection is not working if $\_SERVER\['REMOTE\_ADDR'\] == 127.0.0.1 so if you are working on your local instance restrictfe is disabled. To enable it on your local instance insert folowing line: `$GLOBALS['TYPO3_CONF_VARS']['EXTCONF']['restrictfe']['exceptions']['ip'] = '__UNSET';`
- **I am logged out from BE but still frontend is not blocked, why?**From 3.0.0. version after first successful login a cookie is set (name tx\_restrictfe). If that cookie is present then user do not have to authorize again. So delete that cookie and then your frontend should be blocked again.

[Known problems](#id22)
-----------------------

[](#known-problems)

None.

[To-Do list](#id23)
-------------------

[](#to-do-list)

1. Add userFunc for conditions
2. Add pregmatch for all conditions like '~domain'
3. Add support for detecting browser language to see proper lang on "you must log to see the website" warning screen.
4. Make unit tests for conditions array.

[Changelog](#id24)
------------------

[](#changelog)

See

###  Health Score

48

—

FairBetter than 95% of packages

Maintenance50

Moderate activity, may be stable

Popularity37

Limited adoption so far

Community13

Small or concentrated contributor base

Maturity75

Established project with proven stability

 Bus Factor1

Top contributor holds 96.3% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~95 days

Recently: every ~194 days

Total

33

Last Release

350d ago

Major Versions

7.1.2 → 8.0.02017-09-24

8.2.1 → 9.0.02020-04-25

9.0.0 → 10.0.02021-09-05

10.1.0 → 11.0.02024-10-03

11.1.0 → 12.0.02025-04-14

PHP version history (2 changes)10.0.0PHP >=7.4

11.0.0PHP >=8.0

### Community

Maintainers

![](https://www.gravatar.com/avatar/6066d053dfdc12f5a676444f6a40b5b7d0b5a112e0ab746c8b04f4a7201b0624?d=identicon)[sourcebroker](/maintainers/sourcebroker)

---

Top Contributors

[![kszymukowicz](https://avatars.githubusercontent.com/u/1453553?v=4)](https://github.com/kszymukowicz "kszymukowicz (103 commits)")[![klamparski](https://avatars.githubusercontent.com/u/753410?v=4)](https://github.com/klamparski "klamparski (3 commits)")[![mjankiewicz](https://avatars.githubusercontent.com/u/1465174?v=4)](https://github.com/mjankiewicz "mjankiewicz (1 commits)")

---

Tags

developmentproductionstagingtypo3typo3-cms-extensiontypo3-extension

### Embed Badge

![Health badge](/badges/sourcebroker-restrictfe/health.svg)

```
[![Health](https://phpackages.com/badges/sourcebroker-restrictfe/health.svg)](https://phpackages.com/packages/sourcebroker-restrictfe)
```

###  Alternatives

[fluidtypo3/vhs

This is a collection of ViewHelpers for performing rendering tasks that are not natively provided by TYPO3's Fluid templating engine.

1954.1M49](/packages/fluidtypo3-vhs)[typo3/testing-framework

The TYPO3 testing framework provides base classes for unit, functional and acceptance testing.

675.0M775](/packages/typo3-testing-framework)[friendsoftypo3/content-blocks

TYPO3 CMS Content Blocks - Content Types API | Define reusable components via YAML

96374.6k23](/packages/friendsoftypo3-content-blocks)[praetorius/vite-asset-collector

Use AssetCollector to embed frontend assets generated by vite

52255.0k1](/packages/praetorius-vite-asset-collector)[brotkrueml/schema

Embedding schema.org vocabulary - API and view helpers for schema.org markup

33584.6k13](/packages/brotkrueml-schema)[eliashaeussler/typo3-form-consent

Extension for TYPO3 CMS that adds double opt-in functionality to EXT:form

1481.0k](/packages/eliashaeussler-typo3-form-consent)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)