Has a service asked you to whitelist an IP address in Wordfence? Or perhaps you want to whitelist your own IP to avoid being blocked from your site.
This article walks step by step through real examples of whitelisting one or more IP addresses in Wordfence. We’ll also look at why it may be difficult to do the same for your own IP, and two solutions to let you do so.
Table of Contents
How to Whitelist an IP Address in Wordfence
There are several ways to access the area where you can add IP Addresses to a whitelist. Be aware that Wordfence calls this an “Allowlist”, it’s the same thing.
From the main dashboard of the plugin’s settings, you can use the “Manage Firewall” link near the top of the page.
Alternatively, you can find the Firewall Options cog if you scroll down the dashboard.
Clicking either will open the Firewall Options management page, which is divided into multiple sections. Whitelisting is considered to be an Advanced option, so expand that section if it’s collapsed.
Wordfence gives you a big box to add one or more IP addresses or an actual range of IPs.
If you have multiple addresses, make sure you either put one on each line or use a comma. Here are the two formats:
Format 1:
| 190.238.2900.1923 290.338.4900.5923 390.438.3900.6923 |
Format 2:
190.238.2900.1923,290.338.4900.5923,390.438.3900.6923
How you do this will probably depend on how you get the IP addresses you want to whitelist. Often, a service will provide them and you’ll just want to copy-and-paste them into Wordfence.
I’ll walk through a real-life example in the next section.
What To Do When A Service Asks You To Whitelist IP Addresses In Wordfence
A typical example is when you sign up for a reputable service that monitors the uptime of your website.
These services have to reach out frequently to your site to make that it’s responding. Wordfence may see this as a malicious attack.
The company has helpfully added one of the most common uptime services by default. You’ll see it immediately below the Whitelist area where there is a group of named services that are allowed. It’s called “Uptime Robot”.
But I’ll take an example of using a different service that isn’t specially included. This isn’t an endorsement of this service, just an example.
Watchful is one example of a company that provides a monitoring service to watch your site’s availability. If you sign up for their services, they will send the support documentation for whitelisting their IP addresses. Here’s a glimpse of their details:
Despite the HTML bullet points, you can copy the list straight into the Wordfence box. In this example, you’d get three lines of addresses.
If you want to commit the whitelisting, don’t forget to hit the “Save Changes” button at the top of the page.
How To Whitelist A Range Of IP Addresses in Wordfence
The Wordfence box accepts IP address ranges that follow the CIDR guidelines.
This can let you whitelist an entire network. You may only want to do this for a temporary fix to a specific problem.
How To Whitelist Your Home IP Address In Wordfence
Wordfence keeps thinking your own activity is malicious and blocks you? What a pain in the neck. But surely the simple solution is to throw your own IP address into the Whitelist box.
You will find articles out there that suggest you do this. And they helpfully show you how to get your IP address (just type “what’s my IP address” into Google).
The problem is that your home IP address is probably dynamic instead of static. This means that it changes from time to time.
The worst-case scenario is that someone else gets your “old” IP address and now has super-access to your site. In reality, Mary Smith in downtown Poughkeepsie is hardly likely to take advantage of this.
But your new IP address is now going to get blocked – depending on your activity on the site.
The way to address this is to access the internet from a static IP address. I’ll go through two ways to do this.
Option 1: Purchase A Static IP Address From Your Broadband Provider
My own broadband provider has this to say:
All residential [company] customers are provided with a Dynamic IP address….We are unable to provide a Static IP address to residential customers.
Home Broadband Provider
However, they cheerily inform their customers that business accounts can be assigned a static IP address. It’s a fairly hefty price, but a reliable solution.
You will probably find a more cost-effective route by using a VPN provider.
Option 2: Purchase A Static IP Address From A Reputable VPN Service
A VPN is a virtual private network between you and the internet. You access the web via an encrypted tunnel that, among other things, hides your IP address and protects your online identity.
There’s a large number of free, cheap, and not-so-cheap services out there. Be careful with choosing a service, because there are bad actors in this space that will install bad stuff on your machine.
I’ll use NordVPN as an example of a reputable provider. The VPN service itself is very cheap. At the time of writing, it’s about five bucks a month on a one-year plan.
However, the standard service does not include a static IP address. You can purchase a dedicated IP for about seventy bucks for a year.
Is this worth the cost? It depends on how much hassle you’re going through with unblocking your access to your website. Is this happening every day? I’d throw $70 at the problem.
If it’s a very occasional issue, then there’s probably no need for it.
Have You Inadvertently Blocked A Service Or User?
If someone reaches out to you asking for their IP address to be whitelisted, you should check why they are being blocked by Wordfence in the first place.
You may have spotted suspicious activity on your website in the past, and taken the steps to review and block the IP address in Wordfence. You will have added a reason for doing so – now you’ll appreciate the jog to your memory.
Wordfence also lets you block an entire country using the premium service. This may have affected more users than you intended.
We have an article which explores how to use Wordfence to block bots. You may have increased or lowered specific thresholds within the Brute Force options, and inadvertently blocked legitimate activity.
Use the Wordfence Live Traffic View to watch activity on your website for a while. You’ll see who is being blocked, and how often. This should give you clues as to why someone is complaining.
