Stolen and guessed passwords remain one of the main ways attackers break in. Until this year they were the most common starting point for data breaches, and the 2026 Verizon Data Breach Investigations Report shows only attacks on software flaws have now overtaken them. Restricting access by IP address closes the password route: only approved locations can reach your WordPress dashboard, so a password on its own is not enough.
We include IP restriction in our Managed (previously known as Standard) support package and above, and any client can request it.
What is restricting access by IP address?
We can restrict access to your WordPress dashboard based on the IP address of the person trying to reach it. Anyone connecting from an address that is not approved will not see the login page at all. This significantly reduces the chance of unauthorised entry, even by someone who has obtained a valid password.
What is an IP address?
IP stands for Internet Protocol. An IP address is a unique number that identifies your connection to the internet. The older format, IPv4, is four groups of digits, such as 192.0.2.1. The newer format, IPv6, is longer and mixes letters and numbers, such as 2001:db8:85a3::8a2e:370:7334, but does the same job..
Your IP address comes from the network you use to get online:
- at home, usually your broadband provider
- in the office, your firm’s or chambers’ network
- in a station or coffee shop, the public Wi-Fi
- on a phone hotspot, your mobile network
What is my IP address?
Search for “what’s my IP” or visit WhatIsMyIP.com. If you use an office network, check with your IT team, as there may be a range of addresses involved.
Different types of IP restriction
There are several types of IP restriction. The right one depends on how and where your team works.
1. Allowlisting IP addresses
The strongest method blocks every IP address except those on an approved list held by our hosting partners. The list usually includes your office network, any VPNs you use, and one we use for accessing restricted client sites.
Working from home or on the move
Office networks usually use the same address, or range of addresses, every time, so they are easy to add to the list.
Home working is different. If you’re working from home using a consumer broadband provider, your IP address will likely change regularly, and a new request will need to be made each time it does. Mobile hotspots and public Wi-Fi change even more often.
Solution: a VPN with a fixed IP address
Instead, you may like to consider a VPN service with a “fixed IP address” feature. We can recommend NordVPN for individuals, or GoodAccess for teams.
Once that address is on the allowlist, you can log in from home, the office or anywhere else.
2. Blocklisting IP addresses
A less restrictive measure is to block suspicious IP addresses, for example those making repeated failed login attempts. This can be done manually in the hosting control panel, or automatically by security plugins such as Kadence Security or Wordfence.
3. Restricting IP addresses by country
Another option is to block IP addresses from certain countries, either from logging in or from visiting your site at all. This is less effective than it sounds. Anyone can use a VPN to appear to be connecting from another country, and blocking whole regions can shut out genuine clients, colleagues or instructing solicitors abroad.
What IP restriction doesn’t do
IP restriction protects your login page and dashboard. It does not protect the rest of your site:
- It will not stop attacks that exploit a flaw in a plugin or theme, because those can be reached through your public pages. In Verizon’s 2026 report, 31% of breaches started this way, making it the most common route in.
- It will not help if a device on an approved network, or the VPN account itself, is compromised.
- It does not replace strong passwords or two-factor authentication.
It works best as one layer of protection alongside prompt updates, monitoring and two-factor authentication. For more on those, see When, not if: a realistic guide to WordPress security for law firms and chambers and Beyond passwords: 2FA, MFA and passkeys explained.
What if I’m locked out?
If your IP address changes, you will likely see a 403 error page instead of the login screen. Your website is unaffected, and visitors can still see it as normal.
To regain access, find your new IP address and send it to [email protected]. We will ask our hosting partners to add it to the allowlist.
Next steps
If you would like us to set up IP restrictions on your website, or if you have any questions, email [email protected] to get started.
