Founding offer 50% off all plans for the first 100 customers, and your renewal price is locked for life. 74 spots left Claim your spot
Turquoise abstract wavy W logo on a black background
Turquoise abstract wavy W logo on a black background
White WP PowerSuite logo on a black background
White WP PowerSuite logo on a black background

Summarize with AI:

On This Page
Last updated: 24/07/2026

IP Allow & Block List Pro

Allow or block visitors by IP address—ideal for office-only dashboards or shutting out known troublemakers. Rules apply site-wide, including wp-admin and login.

Overview

A Pro Security module (slug ip-whitelist-blacklist, display name IP Allow & Block List) that allows or blocks visitors by IPv4/IPv6/CIDR. Blacklist mode (default) or whitelist mode; “Add my IP”; custom blocked page; Cloudflare CF-Connecting-IP awareness and custom real-IP headers. Rules apply site-wide—including wp-admin, login, REST, AJAX, and XML-RPC—with no role bypass. Whitelist with zero IPs does not enforce; saving can be blocked if your current IP is missing from a whitelist. Requires a valid WP PowerSuite license. High lockout risk on dynamic home IPs.

Solid black square
Solid black square
Who is this for?
  • Office-only staging or admin access
  • Sites blocking known abusive IPs/ranges
  • Not casual “set and forget” for dynamic residential IPs

Features

Allow or block modes
Blacklist troublemakers or whitelist trusted networks.
IPv4 / IPv6 / CIDR
Precise ranges plus “Add my IP.”
Site-wide enforcement
Front, wp-admin, login, REST, AJAX, XML-RPC.
Custom blocked page
Default or HTML response for denied visitors.
Proxy-aware options
Cloudflare connecting IP and custom real-IP headers.
Safety on whitelist save
Helps prevent locking yourself out

Use Cases

  • Staging office-only
    Whitelist the agency and client office CIDRs.
  • Block abusive ranges
    Blacklist known scrapers or attackers.
  • Soft private previews
    Combine with Password Protection for layered staging gates.

Frequently Asked Questions

Related Modules

Block anonymous access to WordPress core REST endpoints (users, settings, themes, and similar) while leaving logged-in staff and third-party plugin REST routes...
Disabled
Closes the old XML-RPC channel many password-guessing tools still target. Fine for most sites; skip if you rely on legacy apps or...
Disabled
Blocks risky default usernames during registration so bots have fewer easy targets.
Disabled
Tell modern browsers to enforce sensible safety rules—like blocking sneaky scripts and iframe tricks—with strong defaults you can tighten further for HSTS...
Disabled
Removes WordPress version from public HTML generator tags, feed generator output, and the admin footer. Does not change ver= on script and...
Disabled
Slow down password-guessing bots by locking out repeated failed logins for increasing cool-off periods—simple protection for your sign-in form.
Disabled
Google reCAPTCHA on logins, forms, comments, and WooCommerce to block bots and spam signups.
Disabled
Two-factor login for selected roles—extra proof beyond the password.
Disabled
Automatically protects visible email addresses and mailto links from basic spam bots by safely encoding them while keeping them clickable for visitors.
Disabled
Ask a quick math question, custom prompt, or image check before someone can submit a form or log in. Everything runs on...
Disabled
Founding Member Offer 74 of 100 spots left

Before you go, here's what you'd be leaving.

WP PowerSuite launched this month. The first 100 customers get 50% off and keep that renewal price permanently. When the offer closes on 31 August 2026, prices return to $79 / $239 / $399 and stay there.

  • 154 modules, all included on every plan
  • Renewal price locked for life
  • 14-day refund, one email, no questions
See founding pricing
26 founding members so far 23 days left