An allowlist limits a directory to trusted source IP addresses. It can add a useful layer around a private maintenance area, but it needs stable addresses and a recovery route. It should complement strong authentication, not replace it.
These instructions apply where the web server supports Apache-compatible .htaccess rules. Native NGINX does not read this file. A CDN or reverse proxy can also affect the request seen by the origin server. Keep File Manager or SFTP available so you can restore the previous file if a rule prevents browser access.
IN THIS ARTICLE
01 Plan the protected path
Choose a directory that is genuinely private and identify its dependencies. Restricting an entire WordPress admin directory without understanding public AJAX or other endpoints can break front-end features. Use the application's supported controls or obtain assistance if the path serves both public and private requests.
02 Allow only trusted addresses
- Record your current public IPv4 and IPv6 addresses using a trusted method. Keep File Manager or SFTP access open and back up the target directory's .htaccess.
- Place a supported Apache 2.4 authorization rule in the directory you intend to protect. Replace the documentation addresses below with your actual trusted addresses.
Require ip 192.0.2.10 2001:db8::10This allows a request that matches one of the listed addresses and denies other sources in the affected authorization scope. Review inherited rules before combining conditions. Do not permit a large network unless all users of that network are intended to have access.
03 Verify allowed and denied access
- From the trusted connection, open the protected page and complete its ordinary workflow.
- From a separate connection, such as mobile data, confirm access is denied while unrelated public pages still work.
- Check the result after reconnecting your internet service. A changed dynamic address may require an updated allowlist. Document who maintains it and how access can be recovered.
What should I check if an IP allowlist blocks everyone behind a proxy?
If a CDN fronts the site, ensure the server is configured to recognize trusted proxy addresses and recover the actual client IP. A user-supplied header is not trustworthy by itself. If the rule blocks every user, restore the previous file and ask support to confirm proxy handling and directive support before trying again.