How To Set Allow and Block Lists With BetterShield?

In BetterShield, two lists override the counting for particular people. Always allowed holds addresses that are never locked out, and Never allowed to sign in refuses sign-in to the addresses, usernames or browsers you name. Both are empty by default, under Allow and block lists on BetterShield › Protection › Login & Access.

What it does

Always allowed

Addresses that are never locked out. An address or range here:

• is never counted toward a sign-in lockout or a public form limit, and so is never locked out or closed out;
• never gets the sign-in proof of work;
• skips the address and user-agent entries on Never allowed to sign in;
• keeps the server firewall line quiet for its whole network: a lockout of another address in the same /24 or /64 writes no line, because the recovery link cannot lift a ban at the firewall.

It does not skip a username entry on Never allowed to sign in, or the hidden bot check. Entries are addresses only: in the screen’s words, a user agent is a claim anyone can make.

Never allowed to sign in

Refused at sign-in only, so browsing the site is untouched. Each entry names an address or range, a username, a user-agent fragment, or a mix:

A refused username is checked before the password is. Whoever tries a name on the list is locked out at once, without the usual few tries, whether or not an account holds it: only on a verified connection, never from an address on Always allowed, and only while Sign-in attempt limits is on. That lockout sends no unlock email. A username entry on its own also stops that account’s open sessions and application passwords working on this site. Address and user-agent entries also stop application passwords from that connection.

Step 1: Open BetterShield › Protection › Login & Access

Open BetterShield › Protection › Login & Access and find Allow and block lists.

Step 2: Set Allow and Block Lists

• In the list you want, fill in IP address, or a range like 203.0.113.0/24. On Never allowed to sign in you can use Or a username and Or part of a browser or bot name instead, or alongside it.
• Add a Note saying why the entry exists, then press Add. The row shows it will save with the form.
• Press Save. Saved rows show who added them and when. Remove takes one off, then Save.

Block a name tried at sign-in

On the same screen, Recent sign-in attempts lists the names tried most often. Press Block beside a name to add it to Never allowed to sign in as a username-only entry, from every network. It saves at once with no Note, so you do not use the Save bar. Only a name that is not an account and not already blocked has the button. To undo it, press Remove on that entry and then Save. See See who is trying to sign in.

The finding Sign-in tries with common usernames are not refused has Apply Fix, Refuse These Names, with Undo. It adds the common names on offer as username-only entries, never a name an account here uses. It waits for a confirmed way back in: “Confirm your way back in first: check that the recovery email arrived, or download the recovery codes.”

The fields check as you type: a mistyped address or a range that covers too much is named before you can add it, and the same entry twice reads “Already on the list.”

From the terminal, wp bettershield blocklist lists Never allowed to sign in, and wp bettershield blocklist add and remove change it, for example wp bettershield blocklist add --range=203.0.113.0/24 --note="Scanner" --user=admin. See WP-CLI commands.

Recommended settings

• Always allowed: only fixed public addresses you control, such as an office or an agency. Leave out home broadband and mobile addresses, which change, and never add a hosting provider’s whole range.
• Never allowed to sign in: use it sparingly. Lockouts already deal with guessing. A username entry is a quick stop for one account while you look into it; removing or demoting the account is the lasting fix, and revoking its application passwords goes with it. A user-agent fragment suits a tool that names itself in its browser string.

What it can break, and how to undo

• Blocking your own network. Your username cannot be added, and the save refuses a new address, range or user-agent entry that matches the connection or browser you are saving from, unless an Always allowed entry lets you past it (and then removing that entry is refused). A range can still cover a network you use at other times, such as home or mobile, and refuse you there. Another administrator can remove it, or your recovery link or wp bettershield recover turns on safe mode, which pauses both lists. See Locked out.
• A wide allowed range. Everyone inside it is exempt from lockouts and form limits. Keep entries as narrow as you can.
• A short user-agent fragment. Choose a distinctive one; a common word matches ordinary browsers.

Removing a block or adding an allowed address gives something away, so with password confirmation on it asks for your password. Each save is recorded as “Login protection changed”.

Final Outcome

The card’s header reads, for example, “1 allowed · 2 blocked”, and each list’s header counts its entries.

• Recent sign-in attempts marks a name added with Block as Blocked.
• The activity log records refused sign-ins as “Sign-in refused by blocklist” (in a flood of more than 500 an hour, the rest of that hour are counted rather than listed one by one).
• Settings export. wp bettershield settings export includes both lists (without who added each entry), so you can copy them to another site with wp bettershield settings import.

On multisite

Each site keeps its own lists.

Related

• Login & Access
• See who is trying to sign in
• Sign-in lockouts
• Public form limits
• Proxies and Cloudflare
• WP-CLI commands

This is how you can set allow and block lists with BetterShield.

Getting Stuck? Feel free to contact our Dedicated Support Team.