Knowledgebase
How to block IP addresses in Drupal
If you want to ban certain IP addresses so that they can not access your site at all, you can do that by using the built-in Drupal feature for blocking IP addresses.
Log in to the admin panel of your Drupal, click on the Configuration tab in the top navigation bar and on the page that opens click on IP address blocking (it's in the section labeled People). On the page that opens type the IP address in the field labeled IP address, and then click on the Add button. You can block as many IPs as you want. They will be listed in the table on the same page. If you want to remove an IP address from the list with the blocked ones, just click on its delete button in the table.
You can protect specific folders on your Drupal hosting account, or any folder on your account in general by adding an .htaccess file in that folder (if there isn't one), and putting a simple rule in that file. To learn how to do it read the article on protecting folders on your hosting account.
By default, in the .htaccess file in the root Drupal directory on your account there are some rules for protecting many of the files and directories of your Drupal application.