Thanks Vishal,

Here's the thing. He created his own username and password somehow. Even though the admin is protected! He's in there messing with fileman, admin, everything. He doesn't seem to know our original login (or perhaps he does and then made one for himself. Who knows. I'm currently looking over miles of logs to try to find out more). Anyway, having only our IPs accepted would be great. Would you (or someone out there) help me with this? My guess would be something like the following in the admin directory?

Order deny, allow
Deny from all
Allow from myiphere

Would Links SQL still run correctly?

Thanks again!