Skip to content
Awesoft

IP Whitelist Plugin

Limit the WordPress admin and login page to trusted IPv4/IPv6 addresses and CIDR ranges, with proxy support and a lock-out guard.

1 of 4

Overview

IP Whitelist limits the WordPress dashboard and login page to a list of IP addresses you trust: an office network, a VPN exit, your home connection. Any other visitor who opens /wp-admin or /wp-login.php receives a 403 “Access Denied” response, so brute-force bots and curious strangers never reach the dashboard, while the public site keeps working for everyone.

Features

  • Admin and login protection: covers /wp-admin and /wp-login.php; login protection can be switched off separately.
  • IPv4, IPv6 and CIDR ranges: single addresses or whole networks such as 203.0.113.0/24 or 2001:db8::/32, one per line, with optional comments after #.
  • Lock-out guard: the settings page shows the IP address WordPress sees for you with an “Add to list” button, and the whitelist refuses to enable itself unless your own address is on the list.
  • Proxy and Cloudflare aware: choose where the visitor IP comes from: the connection address (default) or the X-Forwarded-For, X-Real-IP or CF-Connecting-IP header. Headers are never trusted unless you select them.
  • Custom message: set the text blocked visitors see.
  • Public features keep working: admin-ajax.php, cron, WP-CLI, front-end admin-post.php submissions and password-protected post forms are not blocked.
  • Developer friendly: an awesoft_ip_whitelist_allowed filter for custom allow rules, and all options are removed when the plugin is deleted.

Install

wp plugin install awesoft-ip-whitelist --activate

Or search for “IP Whitelist” by Awesoft under Plugins › Add New. Then open Settings › IP Whitelist, click Add to list next to your detected IP address, pick the matching visitor IP source if the site sits behind a proxy or CDN, tick Enable the IP whitelist and save. Requires WordPress 6.0 and PHP 7.4 or newer; tested up to WordPress 7.1.

Locked out?

Add this line to wp-config.php and the whitelist is bypassed immediately:

define( 'AWESOFT_IP_WHITELIST_DISABLE', true );

Log in, fix the list, then remove the line again.

More for WordPress