diff --git a/docroot/.htaccess b/docroot/.htaccess
index c45bffd..ce44b93 100644
--- a/docroot/.htaccess
+++ b/docroot/.htaccess
@@ -1,6 +1,18 @@
 #
 # Apache/PHP/Drupal settings:
 #
+Header append Vary "X-Auth"
+
+# Shared Key sent by CDN identifies authorised requests.
+SetEnvIf X-Auth e0c7f121-df2a-4dc6-8099-cc4a8d4aa36b AuthorisedUpstream=1
+
+# Allow traffic from Acquia (monitoring, support, TAM).
+SetEnvIf X-Acquia-Request "TRUE" AuthorisedUpstream=1
+
+# Inverse Search to bypass lockdown checks on non-production environments.
+SetEnvIf AH_SITE_ENVIRONMENT "^((?!prod).)*$" AuthorisedUpstream=1
+
+Require env AuthorisedUpstream

 # Protect files and directories from prying eyes.
 <FilesMatch "\.(engine|inc|install|make|module|profile|po|sh|.*sql|theme|twig|tpl(\.php)?|xtmpl|yml)(~|\.sw[op]|\.bak|\.orig|\.save)?$|^(\.(?!well-known).*|Entries.*|Repository|Root|Tag|Template|composer\.(json|lock))$|^#.*#$|\.php(~|\.sw[op]|\.bak|\.orig|\.save)$">