WordPress IP allowlist and blocklist without locking yourself out
To allowlist or blocklist an IP address in WordPress without locking yourself out, use two lists that override the counting for particular people: addresses that are never paused, and addresses, usernames or browsers that are refused at sign-in. BetterShield calls them Always allowed and Never allowed to sign in, and both are empty until you add something. This guide covers what each one does, how to fill them in, and the settings we recommend.
It builds on limiting login attempts, which explains the pauses these lists override. If a list ever does catch your own network, getting back in is the post to open.
Quick summary
- Always allowed holds addresses or ranges that are never counted toward a sign-in pause or a public form limit, never get the sign-in puzzle, and skip the address and browser entries on the other list.
- Never allowed to sign in refuses sign-in to an address or range, a username, a browser fragment, or a mix. Browsing the site is untouched.
- Both lists are empty by default, hold up to 500 entries each, and live under BetterShield › Protection › Login & Access, in Allowed and refused.
- The save refuses an entry that would match the connection you are saving from, and your own username cannot be added.
- Pauses already deal with password guessing, so we recommend the refuse list sparingly and the allow list only for fixed public addresses you control.
Why two lists
By default every address is treated alike: too many wrong passwords from one connection and it is paused for a while. That is what you want for strangers, and an annoyance for a team behind one office address, where a few forgotten passwords on a Monday morning can add up to a pause for everyone sharing it.
The first list answers that. The second answers the opposite case, when you already know who you do not want to sign in, such as one account you are investigating or a scanner that names itself in its browser string. Neither list replaces the automatic pauses; they sit on top of them.
What Always allowed does
An address or range on this list:
- is never counted toward a sign-in pause or a public form limit, so it is never paused or closed out;
- never gets the sign-in puzzle;
- skips the address and browser entries on Never allowed to sign in;
- keeps the server firewall log quiet for its whole network, because a recovery link cannot lift a ban at the firewall.
It does not skip a username entry on the other list, or the hidden bot check. Entries are addresses only: a browser string is a claim anyone can make, so it never earns an exemption.
What Never allowed to sign in does
This list refuses sign-in only. Each entry names an address or range, a username, a browser fragment, or a mix, and what it refuses depends on the combination:
| Entry | What it refuses | What the person sees |
|---|---|---|
| Address or range only | Sign-in from that range, on verified connections only | “Sign-in is not available from this connection.” |
| Username only | That account, from anywhere, even from an Always allowed address | The message a wrong password gets, so the name is not confirmed |
| Browser fragment only | Any connection whose browser string contains it, case ignored | “Sign-in is not available from this connection.” |
| Username with a range or fragment | That account, only from there | The wrong-password message |
| Range with a fragment | Connections matching both | “Sign-in is not available from this connection.” |
A refused username is checked before the password. Whoever tries a name on the list is paused at once, whether or not an account holds that name, but only on a verified connection, never from an address on Always allowed, and only while Sign-in attempt limits is on. That pause sends no unlock email. A username entry on its own also stops that account’s open sessions and application passwords working on the site.
The words “verified connection” matter. BetterShield acts on an address only when it can tell who is really connecting, which behind a proxy or a CDN needs a setting. Proxies, load balancers and Cloudflare explains it, and it is worth reading before you rely on either list, and getting the visitor’s real IP behind Cloudflare or a proxy walks through the setup.
Set it up
- Open BetterShield › Protection › Login & Access and find Allowed and refused.
- In the list you want, fill in IP address or CIDR range, for example 203.0.113.0/24. On Never allowed to sign in you can use Or a username and Or a user-agent fragment instead, or alongside it.
- Add a Note saying why the entry exists, then press Add. The row shows it will save with the form.
- Press Save. Saved rows show who added them and when. Remove takes one off, then Save.
| Option | What it does | Default |
|---|---|---|
| Always allowed | Addresses or ranges exempt from counting, pauses and the puzzle. Up to 500 entries. | Empty |
| Never allowed to sign in | Addresses, usernames and user-agent fragments refused at sign-in. Up to 500 entries. | Empty |
| IP address or CIDR range | One address, or a range no wider than /8 (IPv4) or /32 (IPv6). | |
| Or a username | An account name. Your own cannot be added. | |
| Or a user-agent fragment | Four characters or more, matched anywhere in the browser string. | |
| Note | Why the entry exists. Optional. |
A range is written in CIDR notation: an address, a slash and a number saying how much of the address is shared. The fields check as you type, so a mistyped address or a range that covers too much is named before you can add it, and the same entry twice reads “Already on the list.”
From the terminal, wp bettershield blocklist lists Never allowed to sign in, and wp bettershield blocklist add and remove change it, for example wp bettershield blocklist add --range=203.0.113.0/24 --note="Scanner" --user=admin. See WP-CLI commands.
What it can break, and how to undo
- Blocking your own network. Your username cannot be added, and the save refuses a new address, range or browser entry that matches the connection you are saving from, unless an Always allowed entry lets you past it. A range can still cover a network you use at other times, such as home or mobile, and refuse you there.
- A wide allowed range. Everyone inside it is exempt from pauses and form limits. Keep entries as narrow as you can.
- A short browser fragment. A common word matches ordinary browsers. Choose a distinctive one.
To undo any of it, Remove the row and Save. If you are the one locked out, another administrator can remove the entry, or your recovery link or wp bettershield recover turns on safe mode, which pauses both lists. See Locked out.
Removing a block or adding an allowed address gives something away, so with password confirmation on it asks for your password. Each save is recorded as “Login protection changed”.
Check it is working
- The card’s header reads, for example, “1 allowed · 2 refused”, and each list’s header counts its entries.
- The activity log records refused sign-ins as “Sign-in refused by blocklist”. In a flood of more than 500 an hour, the rest of that hour are counted rather than listed one by one.
- Settings export.
wp bettershield settings exportincludes both lists, without who added each entry, so you can copy them to another site withwp bettershield settings import.
On a multisite network, each site keeps its own lists.
Recommended settings
We recommend keeping both lists short.
- Always allowed: only fixed public addresses you control, such as an office or an agency. Leave out home broadband and mobile addresses, which change, and never add a hosting provider’s whole range.
- Never allowed to sign in: use it sparingly, because pauses already deal with guessing. A username entry is a quick stop for one account while you look into it; removing or demoting the account is the lasting fix. A browser fragment suits a tool that names itself in its browser string.
| Site | What we recommend |
|---|---|
| Store (WooCommerce) | Leave Always allowed empty unless your staff work from a fixed office address. |
| Agency or many sites | Add your office’s fixed addresses to Always allowed on every client site, with a Note naming the office. |
Frequently asked questions
How do I whitelist an IP address for WordPress login?
Add it under Always allowed in Allowed and refused on BetterShield › Protection › Login & Access, with a Note, then press Add and Save. From then on that address is never counted toward a sign-in pause.
Does an allowed address skip every check?
No. It skips pauses, form limits, the sign-in puzzle and the address and browser entries on the refuse list. It does not skip a username entry on Never allowed to sign in, or the hidden bot check.
Can I block an IP address from signing in without blocking the whole site?
Yes. Never allowed to sign in refuses sign-in only, so browsing the site is untouched.
What if I block my own address by mistake?
The save refuses an entry that matches the connection you are saving from. If a range still covers a network you use later, another administrator can remove it, or the recovery link or wp bettershield recover turns on safe mode, which pauses both lists.
Do I need to do anything if my site is behind Cloudflare?
Yes, one thing. Address entries act only on verified connections, so tell BetterShield the site is behind Cloudflare when its card asks. Proxies, load balancers and Cloudflare has the steps.
Conclusion
Two short lists give you control of the few cases that automatic pauses cannot know about: the office that should never be paused, and the account or tool you do not want signing in. Keep them narrow, add a note to every row, and remember that removing a row is the undo. BetterShield is free on WordPress.org; the full reference is Allow and block lists, and the pauses they sit on top of are in Sign-in lockouts.