Does anyone know whether there is a method of restricting access to the /umbraco folder if one doesn't have access to IIS?  IIS is our usual approach but we're setting up an Umbraco site for someone on a shared host and so IIS restrictions aren't an option in this instance.

Is it possible via the web.config, or maybe creating a web.config to the /umbraco directory with something along these lines:

<security>
    <ipSecurity allowUnlisted="false">
        <clear/>
        <add ipAddress="111.111.111.111" allowed="true"/> <!-- Allow a specific IP -->
        <add ipAddress="111.222.333.444" allowed="true"/> <!-- and another one... -->
    </ipSecurity>
</security>

Would this work, or is there a better/alternative way of approaching this?

Many thanks,
Mike