I have an PHP API that I want to be consumed only by one static website.

However the HTTP is not secure as from what I suspect any header can be spoofed (IP - I may be wrong here, domain name, and so on), so what are my options to ensure that API request came from exactly that website?

The stack is Docker, Nginx, and PHP. Both API and website have Let's Encrypt SSL certificate.


IP Spoofing, successful three way handshake (which used by TCP protocol) is not at everyone's fingertips. Yes TCP have security issues and also there is spoofing techniques but I believe your level of interest does not require that much attention. HTTP works over TCP.

Would you want to have one of the following solution.

  • If you are using a cloud provider, use their "security group" configuration for restricting access of website. Use outgoing ip address of that website. If this website is service provider, they will provide outgoing ip address.
  • If this application stored at a hosting firm, you don't have much choise, migrate this app to cloud or search for "php firewall"
  • If you have your dedicated server (virtual or not) and does not have firewall, you can check services like CloudFlare, Sucuri etc.
  • If you are looking for enterprise grade integration between them, deploy a tunnel for that communication (both parties need to install / configure)

I can think of VLAN with these 2 servers and ACLs to restrict traffic with any other server these may depend on. But depending on the specifics of your network and interactions, following might be applicable: iptable, micro segmentation. I recommend to read the 'Segmentation' chapter of Defensive Security Handbook.


IP and domain cannot be easily spoofed. Spoofing the source of a TCP connection is almost impossible: TCP uses random sequence number when negotiating the connection, and the attacker would need to guess the number, while not being able to see any reply from your API server. Spoof the domain would involve the attacker compromising the zone records for the attacked domain. Doable, but is not something trivial.

If this static website have a public and fixed IP, you can trust $_SERVER['REMOTE_ADDR']. A malicious client will not be able to forge its own IP, and any other header is not useful for him. If the client is behind a proxy or NAT, $_SERVER['REMOTE_ADDR'] will have a private address, like, but I don't believe your static website would be hosted on a private address.

Besides PHP, you can use you database access controls to allow only that specific IP, and nothing else. If you are using Apache 2.4, you can load the authz_core module and add Require ip on the Location or Directory entry on the domain config file, or on the .htaccess file on your API folder.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.