Good question. Ideally, each user's timezone would be required information. The server would check to see if the requesting user's local time meant that the website should be "open" for them.
Also who is this to protect? The user? What if they work midnights or their days are backwards?