# IP Whitelist Plugin

Limit the WordPress admin and login page to trusted IPv4/IPv6 addresses and CIDR ranges, with proxy support and a lock-out guard.

## Details

- Platform: WordPress
- Published: January 31, 2025
- Updated: October 11, 2026
- Distribution: WordPress.org plugin directory
- Price: Free
- Install: `wp plugin install awesoft-ip-whitelist --activate`
- View on WordPress.org: https://wordpress.org/plugins/awesoft-ip-whitelist/

## Overview

IP Whitelist limits the WordPress dashboard and login page to a list of IP addresses you trust: an office network,
a VPN exit, your home connection. Any other visitor who opens `/wp-admin` or `/wp-login.php` receives a 403
"Access Denied" response, so brute-force bots and curious strangers never reach the dashboard, while the public
site keeps working for everyone.

## Features

- **Admin and login protection:** covers `/wp-admin` and `/wp-login.php`; login protection can be switched off
  separately.
- **IPv4, IPv6 and CIDR ranges:** single addresses or whole networks such as `203.0.113.0/24` or `2001:db8::/32`,
  one per line, with optional comments after `#`.
- **Lock-out guard:** the settings page shows the IP address WordPress sees for you with an "Add to list" button,
  and the whitelist refuses to enable itself unless your own address is on the list.
- **Proxy and Cloudflare aware:** choose where the visitor IP comes from: the connection address (default) or the
  `X-Forwarded-For`, `X-Real-IP` or `CF-Connecting-IP` header. Headers are never trusted unless you select them.
- **Custom message:** set the text blocked visitors see.
- **Public features keep working:** `admin-ajax.php`, cron, WP-CLI, front-end `admin-post.php` submissions and
  password-protected post forms are not blocked.
- **Developer friendly:** an `awesoft_ip_whitelist_allowed` filter for custom allow rules, and all options are
  removed when the plugin is deleted.

## Install

```bash
wp plugin install awesoft-ip-whitelist --activate
```

Or search for "IP Whitelist" by Awesoft under Plugins › Add New. Then open Settings › IP Whitelist, click
**Add to list** next to your detected IP address, pick the matching visitor IP source if the site sits behind a
proxy or CDN, tick **Enable the IP whitelist** and save. Requires WordPress 6.0 and PHP 7.4 or newer; tested up to
WordPress 7.1.

## Locked out?

Add this line to `wp-config.php` and the whitelist is bypassed immediately:

```php
define( 'AWESOFT_IP_WHITELIST_DISABLE', true );
```

Log in, fix the list, then remove the line again.

---

Canonical: https://awesoft.dev/wordpress/plugin-ip-whitelist/
Markdown: https://awesoft.dev/wordpress/plugin-ip-whitelist/index.md