Get Started

IP Blocking Issues

Blocked and allowed lists, CIDR ranges, and the two features this plugin has never had.

  • Intermediate
  • 20 min read
  • Applies to 1.2.1 Pro
  • Updated December 2025

Written for 1.2.1 Pro. It is being checked against 2.0, so a screen or a setting may sit somewhere else. Tell support if something does not match.

Overview

IP blocking protects a site and occasionally locks out the person running it. This page covers the blocked and allowed lists, CIDR ranges, and the two things people most often come here looking for and will not find.

Issue 1: Admin Locked Out by IP Rules

Symptoms

- Configured IP whitelist
- Can't access admin panel anymore
- "Access denied" or redirect to homepage

Solution 1: Emergency Access

Via wp-config.php:

// Add to wp-config.php TEMPORARILY
define('ATTRUA_DISABLE_IP_BLOCKING', true);

// After regaining access:
// 1. Fix IP whitelist
// 2. Remove this line

Solution 2: Database Fix

Disable IP blocking via database:

-- Connect via phpMyAdmin

-- Empty the blocked list. 'a:0:{}' is an empty serialised array, which is
-- what the plugin expects to read back — do not write 0 or an empty string.
UPDATE wp_options
SET option_value = 'a:0:{}'
WHERE option_name = 'attrua_blocked_ips';

There is no attrua_ip_blocking_enabled option. Whether the feature is on lives inside attrua_pro_security_settings, a single serialised array holding every security setting, so it cannot be flipped with one UPDATE without rewriting the rest. Emptying the blocked list above is what unblocks you.

If you want the feature itself off, WP-CLI does it safely:

wp option patch delete attrua_pro_security_settings enable_ip_blocking

Solution 3: Add Current IP to Whitelist

Via phpMyAdmin:

-- First, find your current IP by visiting: https://whatismyipaddress.com

The allowed list is an option, not a table. There is no wp_attrua_ip_whitelist to INSERT into — the list is a serialised array in wp_options under attrua_allowed_ips, keyed by address. Hand-writing serialised PHP into a column is how you corrupt an option, so add the address with WP-CLI instead:

wp option patch update attrua_allowed_ips 203.0.113.50 \
  --format=json '{"ip":"203.0.113.50","note":"emergency recovery"}'

Or, once you are back in, from User Access → IP Manager → Allowed IPs, which is the same list through a screen that cannot mangle it.

Issue 2: CIDR Notation Not Working

Symptoms

- Added IP range in CIDR format: 192.168.1.0/24
- Still blocked or not working as expected
- Individual IPs work, ranges don't

Common CIDR Mistakes

Wrong format:

❌ 192.168.1.1-192.168.1.255  (Range format not supported)
❌ 192.168.1.*  (Wildcard not supported)
❌ 192.168.1.0/24/  (Extra slash)
❌ 192.168.1.0 /24  (Space before slash)

✅ 192.168.1.0/24  (Correct CIDR format)
✅ 10.0.0.0/8  (Class A network)
✅ 172.16.0.0/12  (Class B network)

CIDR Quick Reference

Common network sizes:

/32 = Single IP (192.168.1.50/32)
/24 = 256 IPs (192.168.1.0/24 = .0 through .255)
/16 = 65,536 IPs (192.168.0.0/16)
/8 = 16,777,216 IPs (10.0.0.0/8)

Office network examples:
Small office: 203.0.113.0/28 (16 IPs)
Medium office: 203.0.113.0/24 (256 IPs)
Large office: 203.0.113.0/22 (1,024 IPs)

Testing CIDR Ranges

Verify IP falls within range:

Use online calculator:
https://www.ipaddressguide.com/cidr

Example:
Range: 192.168.1.0/24
Test IP: 192.168.1.50
Result: ✅ Within range

Test IP: 192.168.2.50
Result: ❌ Outside range

Two things this plugin does not do

There is no geographic blocking, and no VPN or proxy detection. Neither feature exists in any version — there is no GeoIP database to download, no country list to allow or deny, and no menu called "IP Security". The only mention of GeoIP anywhere in the code is a comment in the audit log saying such a service could be added.

Earlier versions of this page described both at length, including screens and settings. They were never real. If you need to block by country, put it in front of WordPress — Cloudflare, your CDN or your web server all do it, and they do it before the request costs you any PHP.

The IP Manager works on addresses and ranges only: User Access → IP Manager, with a Blocked list and an Allowed list.

Issue 5: Dynamic IP Addresses

Symptoms

- Employee whitelisted yesterday
- Can't access today
- IP address changed overnight

Solution 1: Whitelist IP Range

Instead of single IP, whitelist range:

Contact ISP to determine IP allocation range

Example:
ISP assigns IPs from: 203.0.113.0 to 203.0.113.127
Whitelist: 203.0.113.0/25 (covers .0 through .127)

This works even when specific IP changes

Solution 2: Use DDNS (Dynamic DNS)

For remote employees with dynamic IPs:

1. Employee sets up DDNS service:
   - DynDNS
   - No-IP
   - DuckDNS (free)

2. Gets hostname like: johndoe.ddns.net

3. Admin adds hostname to whitelist
   (Requires plugin that supports hostname whitelisting)

Solution 3: Use VPN Access

Better long-term solution:

Set up corporate VPN:
1. All employees connect to VPN
2. VPN provides static exit IP
3. Whitelist VPN IP only
4. Employees' home IPs irrelevant

Recommended VPN services:
- NordLayer (business VPN)
- Perimeter 81
- Twingate

Issue 6: Cloud Services Blocked

Symptoms

- Scheduled tasks failing
- API integrations blocked
- Webhooks not working
- Cloud services can't access site

Solution: Whitelist Cloud Provider IPs

Common cloud service ranges:

Amazon AWS:

Download AWS IP ranges:
https://ip-ranges.amazonaws.com/ip-ranges.json

Add relevant regions to whitelist
Example: us-east-1 region IPs

Google Cloud:

https://www.gstatic.com/ipranges/cloud.json

Microsoft Azure:

https://www.microsoft.com/en-us/download/details.aspx?id=56519

Cloudflare:

https://www.cloudflare.com/ips/

Warning: Cloud IP ranges are large. Only whitelist if absolutely necessary. Consider API authentication instead.

Issue 7: Blacklist Not Blocking

Symptoms

- Added IP to blacklist
- That IP still accesses site
- Blacklist seems ineffective

Solution 1: Check Blacklist Priority

Verify whitelist isn't overriding:

Rule Priority:
1. Whitelist (highest priority - always allow)
2. Blacklist (blocks unless whitelisted)

If IP in both whitelist AND blacklist:
→ Whitelist wins, IP allowed

Solution: Remove from whitelist if want to block

Solution 2: Check for Cached Pages

Blacklist applies to authenticated pages:

If user accessing cached public pages:
- CDN may serve cached content
- Bypass IP checking entirely

Solution:
- Exclude cached pages from CDN
- Or use firewall-level blocking (CloudFlare, Sucuri)

Solution 3: Block at Server Level

For serious threats, use .htaccess:

# Add to .htaccess
<RequireAll>
    Require all granted
    Require not ip 198.51.100.50
    Require not ip 203.0.113.0/24
</RequireAll>

Or Nginx:

# Add to nginx config
deny 198.51.100.50;
deny 203.0.113.0/24;

Issue 8: Mobile Users Blocked

Symptoms

- Desktop access works
- Mobile/cellular network blocked
- Users on 4G/5G can't login

Solution: Understand Carrier NAT

Mobile carrier IP sharing:

Mobile carriers use CGNAT (Carrier-Grade NAT)
Thousands of users share same public IP

If you block one mobile user's IP:
→ You block thousands of users on same carrier

Solution:
- Don't block mobile carrier IPs
- Use device fingerprinting instead
- Or require additional authentication for mobile

Testing IP Blocking

Comprehensive Test Procedure

  • Note your current IP (whatismyipaddress.com)
  • Add your IP to whitelist
  • Test admin access works
  • Remove your IP from whitelist
  • Add your IP to blacklist
  • Test access blocked (use incognito)
  • Remove from blacklist
  • Test access restored
  • Test CIDR range includes your IP
  • Clear all caches between tests

Best Practices

Always Whitelist Your IP First
Before enabling IP blocking, whitelist your own IP to avoid lockout.

Document All IP Entries
Add descriptions to every IP: "John's office", "AWS webhook", "VPN exit IP"

Review IP List Monthly
Remove old IPs. Add new ones. Keep list current.

Layer Your Security
IP blocking + 2FA + password policies = comprehensive security.

Related articles

Something missing or out of date? Tell support.