Skip to main content

IP Access Rules

IP Access Rules​

Last verified: 2026-07-12

IP access rules let Awthy monitor or enforce allow/block decisions for login and admin-area requests. Use them carefully: IP addresses can represent offices, VPNs, mobile carriers, proxies, or shared hosting infrastructure rather than one person.

Modes​

  • Off keeps rules inactive.
  • Monitor records what would happen without blocking the request.
  • Enforce applies matching allow/block decisions.

Start with monitor mode, review the results, then enforce only when the rule set is narrow enough to explain and recover.

Protected surfaces​

Rules can apply to login traffic, admin-area traffic, or both. Login protection helps reduce credential-guessing traffic. Admin protection is stricter and can block legitimate administrators if the source network changes.

Do not enforce admin-area rules until you have tested from the networks administrators actually use.

When admin-area scope is limited to selected capabilities or roles, enter the exact WordPress slugs as a comma-separated list and save that selection. Awthy requires at least one valid slug for a selected scope so an empty selection cannot silently remove protection.

Allow and block rules​

Use block rules for sources you are confident should not reach protected surfaces. Use allow rules for known fixed networks, such as an office VPN or controlled administrative network.

Avoid broad allowlists for consumer ISPs, mobile carriers, or coworking networks. A shared range can include people outside your organization.

Subject rules​

Awthy can scope rules to subjects such as global, role, capability, or user targets. Prefer the smallest scope that matches the risk. A global block is easier to reason about than many overlapping user-specific rules, but a global allow rule can accidentally widen access for everyone.

Allowlist yourself safely​

Before enforcing a rule, confirm your current connection is represented accurately. If you allowlist yourself, verify it from the same network and browser session you expect to use after enforcement.

Do not rely on forwarded headers until trusted proxies are configured correctly. An untrusted X-Forwarded-For header can be spoofed.

Trial and recovery behavior​

Use the safe trial workflow before permanent enforcement. If a trial rule blocks the administrator who created it, Awthy should be able to revert that trial instead of leaving the site inaccessible.

Keep a server-level recovery path available before enforcing admin-area rules. If a rule blocks every administrator, use the documented WP-CLI recovery command or disable the controlling option from a trusted server session. Do not ask users to send full IP logs or raw request headers through support.

Operational boundaries​

  • IP rules are not identity proof.
  • VPNs and carrier NAT can move users between addresses.
  • Proxies must be explicitly trusted before forwarded visitor IPs are used.
  • Audit and support views should use safe previews, not raw full request data.
Last updated on