Restrict access to admin interface by specific IP addresses

Add this code to the site.php file. Replace the example IP addresses in ALLOWED_IPS with the addresses that should have access before saving the file.

class Am_Mvc_Controller_Plugin_CheckIp extends Zend_Controller_Plugin_Abstract
{
    private const ALLOWED_IPS = [
        '203.0.113.10',
        '2001:db8::10',
    ];

    public function preDispatch(Zend_Controller_Request_Abstract $request)
    {
        if (stripos($request->getControllerName(), 'admin') !== 0) {
            return;
        }

        if (!in_array($_SERVER['REMOTE_ADDR'] ?? '', self::ALLOWED_IPS, true)) {
            http_response_code(403);
            exit('Access denied');
        }
    }
}

Zend_Controller_Front::getInstance()->registerPlugin(
    new Am_Mvc_Controller_Plugin_CheckIp(),
    500
);

REMOTE_ADDR is the address that connects directly to the web server. If the site is behind a reverse proxy, it is usually the proxy address. In that case, configure the restriction at the proxy or web-server level instead.