Uncategorized

How to Whitelist Your IP to Access wp-admin During Lockdowns

ajith July 16, 2025

If you’ve ever tried to access your WordPress dashboard during a security lockdown perhaps due to a plugin, firewall rule, or .htaccess configuration and found yourself locked out, you’re not alone. Many website owners implement restrictions on /wp-admin to protect their site from unauthorized login attempts. But what happens when you can’t log in?

The solution lies in IP whitelisting a simple but powerful method to allow only your device’s IP address to access the admin area while keeping everyone else out.

In this article, we’ll walk you through:

  • What IP whitelisting means

  • How to find your IP address

  • How to safely whitelist it via .htaccess, firewall plugins, or web host-level tools

  • Precautions to take to avoid being locked out again

What Is IP Whitelisting?

IP whitelisting is the practice of allowing only specific IP addresses to access certain areas of your website, such as the WordPress admin dashboard (/wp-admin) or the login page (wp-login.php). This is commonly done:

  • During brute-force attacks

  • When restricting access for clients or teams

  • As part of general hardening of a WordPress website

When done correctly, it acts like a digital doorman: Only people with a matching IP can come in.

Step 1: Find Your Public IP Address

Before you whitelist anything, you need to know the IP address of the device you’ll be using to log in.

How to find your IP:

  1. Go to https://whatismyipaddress.com

  2. Copy the IPv4 address (e.g., 103.211.45.67)

  3. If you’re on a dynamic IP (changes frequently), you may need to repeat this step regularly or consider using a VPN with a static IP.

Step 2: Whitelist Your IP via .htaccess (Recommended for Apache Servers)

The .htaccess file is a powerful configuration file used by Apache servers to control site behavior. You can restrict access to wp-admin or wp-login.php using this method.

How to whitelist IP in .htaccess:

  1. Login to your hosting panel (e.g., cPanel) and go to File Manager

  2. Navigate to:

    • /public_html/wp-admin/ for wp-admin

    • /public_html/ for wp-login.php

  3. Edit the existing .htaccess file or create one if not present.

Example Code for /wp-admin/.htaccess:

order deny,allow
deny from all
allow from 103.211.45.67

This will:

  • Deny all IPs

  • Allow only your IP to access /wp-admin

Optional: Also protect wp-login.php from root .htaccess:

<Files wp-login.php>
order deny,allow
deny from all
allow from 103.211.45.67
</Files>

Pro Tip: Always make a backup of the .htaccess file before editing.

Step 3: Whitelist Your IP via Security Plugins

If you’re not comfortable editing files, many WordPress security plugins allow IP whitelisting directly from the admin dashboard (before you’re locked out).

Common Plugins that support this:

  • Wordfence

  • iThemes Security

  • All-In-One WP Security

Example (Wordfence):

  1. Go to Wordfence > Firewall

  2. Click on Blocking

  3. Add a rule to allow your IP, or block all others except yours

If you’re already locked out, you’ll need to disable the plugin temporarily via FTP or File Manager, whitelist your IP, and re-enable it.

Step 4: Whitelist IP at the Server or Web Host Level

If your host provides a web application firewall or IP filtering (many cPanel hosts do), you can whitelist your IP from the control panel.

Example (cPanel IP Blocker or ModSecurity):

  1. Login to cPanel

  2. Go to ModSecurity or IP Blocker

  3. Whitelist your IP in the “Allow List” or firewall rules

What If Your IP Changes Often?

Dynamic IPs (common with mobile hotspots or home broadband) can cause issues.

Workaround options:

  • Use a VPN with a static IP

  • Use .htaccess to allow a full IP range:

    allow from 103.211.45.

    (Less secure but helpful for changing IPs within a range)

  • Create a temporary bypass link (protected with a password) to allow login and then update your IP

Emergency Recovery: Locked Out? Here’s What to Do

If you lock yourself out:

  • Use FTP or File Manager to rename the .htaccess file temporarily

  • Or, disable security plugins from /wp-content/plugins/ by renaming their folders

  • Regain access and fix your IP configuration

Final Thoughts

Whitelisting your IP to access wp-admin is a simple yet effective security measure, especially during times of lockdown, attacks, or maintenance. It ensures that only you (and your trusted team) can access the dashboard even if the site is under siege.

By using .htaccess, plugins, or server-side tools, you can lock down your admin area without sacrificing convenience.