WordPress IP whitelist: manual unblocking and timed bans

matteocisilino — Thu, 05 Nov 2026 08:00:00 +0000

Every automatic defence sooner or later blocks the wrong person. The customer who gets the password wrong five times. The receptionist behind the same IP as the whole office. You yourself while testing a login. That is why the plugin has a WordPress IP whitelist and two ways to step in by hand.

The WordPress IP whitelist: it doesn’t even count as an attempt

An IP in the WordPress IP whitelist is not counted among the failed attempts. This is different from an unblock, which lifts a block that has already happened. Here the block never happens at all. It suits the office network or the service that monitors the site. The price to bear in mind is that even someone attacking from that network would not be stopped. So use it only for addresses you really control.

One-click unblock

The unified list gathers the IPs blocked locally, the ones received from the network and the ones added by hand. Every row, including WordPress IP whitelist entries, has its own “Unblock”.

Timed ban for a specific IP

Want to stop an annoying address, separate from the WordPress IP whitelist, without having to remember to lift the ban? Ban it by hand and choose the duration: permanent, 1 hour, 6 hours, 24 hours or 7 days. The same works in reverse, to unblock an address explicitly.

A typical scenario

An office with three workstations behind a fixed IP. All it takes is one person getting the password wrong several times and the address is blocked for everyone. Putting the office IP in the WordPress IP whitelist settles the matter.

A security note: every address, whatever its source, is checked as a complete IP or CIDR. This happens before it ends up in .htaccess. A manual override therefore cannot insert arbitrary directives into the file. For the wider picture, the official guide to WordPress security hardening is worth a read.

Frequently asked questions

What is the difference between the whitelist and an unblock?

An unblock lifts a block that is already active. The whitelist prevents an IP from being counted as a failed attempt, so the block never happens.

Can I ban an IP for just a few hours?

Yes. A manual ban can be permanent or last 1 hour, 6 hours, 24 hours or 7 days.

Is the WordPress IP whitelist safe for the office IP?

Yes, if you really control that network. An attack starting from there would not be stopped.

The post WordPress IP whitelist: manual unblocking and timed bans first appeared on Matteo Cisilino.

IP unblocking - Matteo Cisilino