\ud83d\udcda In this article, we’ll first quickly explain what IP addresses are<\/a> and then we’ll talk about what whitelisting is<\/a> and how it works. After that we’ll teach you how to whitelist IP addresses<\/a> in WordPress with two simple steps.<\/p>\n\n\n\n Let’s get to work! \ud83d\udcaa<\/p>\n<\/div>\n\n\n\n IP addresses are crucial for enabling communication between devices on the internet. They serve as unique identifiers that facilitate the routing of data. Every device you use, whether it’s your mobile phone or computer, has an IP address. When you open a web browser or run an app, it communicates using the IP address of that device.<\/p>\n\n\n\n Moreover, IP addresses help identify specific internet networks. Each device within your network might have its unique IP address locally. But to the outside world, all traffic from your network often appears to come from a single IP address, provided by your Internet Service Provider (ISP).<\/p>\n\n\n\n \ud83d\udca1 If you’re curious, you can even check what the IP address of your internet network is right now by using our free IP checker tool<\/a>.<\/p>\n\n\n\n In the context of websites, especially platforms like WordPress, grasping the importance of IP addresses is essential. Not only do they route data, but they also play a pivotal role in bolstering security<\/a>. By choosing which IP addresses can access certain parts of your website, you can significantly cut down on the risk of unauthorized access and potential cyber threats.<\/p>\n\n\n\n Which brings us to…<\/p>\n\n\n The terms ‘blacklisting’ and ‘whitelisting’ refer to access controls based on IP addresses. Blacklisting prevents access from specific IP addresses, whereas whitelisting allows access solely to designated IP addresses.<\/p>\n\n\n\n That is – when you whitelist an IP address on a website, you grant access only<\/em> to a specific network. A user can switch devices on that network, but they’ll need to be connected to a network with whitelisted access to reach the backend of your site.<\/p>\n\n\n\n \ud83d\udc49 As you can imagine, this security feature offers a lot of advantages, because it:<\/p>\n\n\n\n It’s important to note that in most cases, you won’t want to limit access to your entire website unless it’s purely a staging site<\/a>. Rather, you’ll just want to secure your back end and its login page.<\/p>\n\n\n Of course, whitelisting IP addresses in WordPress can get tricky if you’re part of a large team. You’ll need to convince everyone to share their IPs with you, and<\/em> figure out what to do for users with dynamic addresses (IPs that change regularly).<\/p>\n\n\n\n Additionally, if you use this method, you won’t be able to access your site’s backend dashboard if you’re at a cafe or on vacation without updating the list of whitelisted IP addresses (because you’ll have a different IP address<\/em>).<\/p>\n\n\n\n In our experience, the best way to approach these problems is to use a VPN service<\/a> that offers your team members dedicated IP addresses. Then, as long as they remember to log into the service before trying to access your back end, they shouldn’t encounter any problems.<\/p>\n\n\n Now that you understand the reasons to whitelist IP addresses in WordPress, it’s time to learn how to make it happen. As we mentioned earlier, you’ll need to tweak one of your WordPress files manually to implement this feature. Don’t worry \u2013 the process is simple, and we’ll guide you through every step.<\/p>\n\n\n\n Before we jump in, it’s a smart idea to back up your site<\/a> just in case. Then, make sure you have a list of all your team members’ IP addresses ready. To find out what their (and your) IPs are, they can use a simple tool such as IP Location Finder<\/a>. All they need to do is visit the site, note down their IP addresses, and share them with you.<\/p>\n\n\n\n The file we need to modify for this feature to work properly is called To do that, you’ll first need to access your site’s back end using an FTP client, such as FileZilla<\/a>. You’ll need your FTP login information. You can find this information in your web host’s control panel or in the email your web host sent when you signed up for your plan:<\/p>\n\n\n Once you have your credentials, access your website via FTP and head to WordPress’ root<\/em> folder. This directory is often called either Now, right click on the file and choose the option that reads View\/Edit<\/em>. This will open the file locally, using your default text editor. Keep the file open for now, and let’s move on to the next step.<\/p>\n\n\n To whitelist a set of IP addresses, you’ll need to copy and paste the following code into your This code snippet restricts access to both your dashboard and its login page. Whenever someone attempts to access either one, WordPress will check their IP against the addresses in your list. If one of them is a match, they’ll be let through.<\/p>\n\n\n\n In the example above, you can see there are two placeholders for individual IP addresses ( Here’s what the code should look like for a site with three whitelisted addresses:<\/p>\n\n\n\n To avoid confusion, you should add this snippet to the bottom of your Now, anyone who isn’t connected to one of the whitelisted IP addresses will see something like this if they try to access your dashboard:<\/p>\n\n\n Learning how to whitelist IP addresses in WordPress is simple, and it’s a highly effective way to protect your website<\/a> from intruders.<\/p>\n<\/div>\n\n\n\nWhat are IP addresses? \ud83e\udd14<\/h2>\n\n\n\n
What whitelisting is (and why it’s effective) \ud83d\udfe2<\/h2>\n\n\n
![\"An](\"https:\/\/mllj2j8xvfl0.i.optimole.com\/cb:c5QE.37290\/w:auto\/h:auto\/q:mauto\/f:best\/https:\/\/themeisle.com\/blog\/wp-content\/uploads\/2017\/08\/ip-address-example.png\")
\n
Potential disadvantages of using this method<\/h3>\n\n\n\n
How to whitelist IP addresses in WordPress (in two steps) \u270c\ufe0f<\/h2>\n\n\n\n
\n
Step 1: Locate your .htaccess <\/em>file \ud83d\udd0d<\/h3>\n\n\n\n
.htaccess<\/code>. It’s a WordPress core file that communicates directly with your server and enables you to set up ‘rules’. In this case, we’re going to tell it to block access to your dashboard login page for IPs not on an approved list.<\/p>\n\n\n\n![\"An](\"https:\/\/mllj2j8xvfl0.i.optimole.com\/cb:c5QE.37290\/w:auto\/h:auto\/q:mauto\/f:best\/https:\/\/themeisle.com\/blog\/wp-content\/uploads\/2017\/08\/ftp-accounts.png\")
<\/figure><\/div>\n\n\npublic_html<\/code> or www<\/code>, or is named after your site. Open it, and look for the .htaccess<\/code> file within:<\/p>\n\n\n![\"Editing](\"https:\/\/mllj2j8xvfl0.i.optimole.com\/cb:c5QE.37290\/w:auto\/h:auto\/q:mauto\/f:best\/https:\/\/themeisle.com\/blog\/wp-content\/uploads\/2017\/08\/htaccess.png\")
<\/figure><\/div>\n\n\nStep 2: Whitelist an IP address by editing your .htaccess <\/em>file \u270d\ufe0f<\/h3>\n\n\n\n
.htaccess<\/code> file (with a few changes):<\/p>\n\n\n\n<IfModule mod_rewrite.c>\nRewriteEngine on\nRewriteCond %{REQUEST_URI} ^(.*)?wp-login\\.php(.*)$ [OR]\nRewriteCond %{REQUEST_URI} ^(.*)?wp-admin$\nRewriteCond %{REMOTE_ADDR} !^IP_ADDRESS_ONE$\nRewriteCond %{REMOTE_ADDR} !^IP_ADDRESS_TWO$\nRewriteRule ^(.*)$ - [R=403,L]\n<\/IfModule><\/code><\/pre>\n\n\n\nIP_ADDRESS_ONE<\/code> and IP_ADDRESS_TWO<\/code>). You can add as many lines as you want following the same format, one right below the other, replacing the placeholder text with the actual IPs. Make sure to leave the “^” and “$” symbols before and after the IP address, though<\/strong>.<\/p>\n\n\n\n<IfModule mod_rewrite.c>\nRewriteEngine on\nRewriteCond %{REQUEST_URI} ^(.*)?wp-login\\.php(.*)$ [OR]\nRewriteCond %{REQUEST_URI} ^(.*)?wp-admin$\nRewriteCond %{REMOTE_ADDR} !^190.36.268.21$\nRewriteCond %{REMOTE_ADDR} !^190.43.281.27$\nRewriteCond %{REMOTE_ADDR} !^190.67.302.44$\nRewriteRule ^(.*)$ - [R=403,L]\n<\/IfModule><\/code><\/pre>\n\n\n\n.htaccess<\/code> file, below its default rules. When you’re ready, save your changes and test that your new security feature is working by having each whitelisted user try and log in. Whenever you gain or lose team members, you can simply return to the file and add or delete IP addresses as necessary.<\/p>\n\n\n\n![\"what](\"https:\/\/mllj2j8xvfl0.i.optimole.com\/cb:c5QE.37290\/w:auto\/h:auto\/q:mauto\/f:best\/https:\/\/themeisle.com\/blog\/wp-content\/uploads\/2017\/09\/wordpress-whitelist.png\")
<\/figure><\/div>\n\nConclusion \ud83e\uddd0<\/h2>\n\n\n\n