diff --git a/glpi-httpd.conf b/glpi-httpd.conf
index dc48482..e17d296 100644
--- a/glpi-httpd.conf
+++ b/glpi-httpd.conf
@@ -7,16 +7,35 @@ Alias /glpi /usr/share/glpi
     php_value memory_limit 64M
 
     <IfModule mod_authz_core.c>
-       Require all granted
+        Require all granted
     </IfModule>
     <IfModule !mod_authz_core.c>
-       Order deny,allow
-       Allow from all
+        Order deny,allow
+        Allow from all
     </IfModule>
 </Directory>
 
 <Directory /usr/share/glpi/install>
 
+    # Install is only allowed via local access (from the GLPI server).
+    # Add your IP address if you need it for remote installation,
+    # but remember to remove it after installation for security.
+
+    <IfModule mod_authz_core.c>
+        # Apache 2.4
+        Require local
+        # Require ip ##.##.##.##
+    </IfModule>
+    <IfModule !mod_authz_core.c>
+        # Apache 2.2
+        Order Deny,Allow
+        Deny from All
+        Allow from 127.0.0.1
+        Allow from ::1
+    </IfModule>
+
+    ErrorDocument 403 "<p><b>Restricted area.</b><br />Only local access allowed.<br />Check your configuration or contact your administrator.</p>"
+
     # migration could be very long
     php_value max_execution_time 0
     php_value memory_limit -1
diff --git a/glpi.spec b/glpi.spec
index 950ce6b..7826fae 100644
--- a/glpi.spec
+++ b/glpi.spec
@@ -254,6 +254,9 @@ fi
 
 
 %changelog
+* Thu Sep 12 2013 Remi Collet <remi@fedoraproject.org> - 0.83.9.1-4
+- restrict access for install to local for security
+
 * Fri Aug 23 2013 Remi Collet <remi@fedoraproject.org> - 0.83.9.1-3
 - drop bundled Flash files files, #1000251