IP Blocking, Whitelisting, and Managing Locked-Out IPs

Three Lists, Three Purposes

The GuardPress → IP Management page shows three tables that do different things. Getting them mixed up is the single most common cause of “why won’t this IP unblock?” tickets.

1. Manual Whitelist (green shield icon)

Storage: guardpress_ip_whitelist option. Populated only by you, the admin. IPs on this list bypass every firewall check GuardPress runs — brute-force counter, rate limiting, geographic access rules, WAF pattern matching, everything. Checked at the very top of every request, before any block is evaluated. Use for:

• Your office IP
• Your home IP (if you work remotely and it’s stable)
• Trusted business partners’ static IPs
• Uptime monitoring services with known IP ranges (UptimeRobot, Better Uptime, etc.)
• Payment gateway callback IP ranges (Stripe, PayPal, when their calls are getting rate-limited)

2. Manual Blacklist (red X icon)

Storage: guardpress_ip_blacklist option. Populated only by you. IPs on this list are permanently blocked at every endpoint — there’s no expiration and no rate limit to trip. Not to be confused with the brute-force auto-lockout below. Use for:

• Persistent attackers who keep coming back from the same IP after their auto-lockout expires
• Known-bad IPs from your host’s security reports
• Ranges you never want to serve, ever (a country’s cellular ranges you don’t do business in — though the Geographic Access Rules section is usually the right tool for whole countries)

3. Active Lockouts & Permanent Bans (yellow lock icon)

Storage: gp_ip_blocklist database table. Populated automatically by the brute-force protection module — you don’t add entries here manually. Each row is either a temporary lockout (with an unblock_at timestamp in the future) or a permanent ban (after the escalation threshold from brute-force protection was hit). Use for:

• Unblocking a real user who got caught in the auto-lockout — two clicks
• Seeing which IPs are currently being blocked and why, without waiting for their expiry
• Clearing test-generated lockouts during development

Whitelisting an IP or Range

The fastest way to whitelist your own IP is the shortcut at the top of the IP Management page.

Blacklisting an IP or Range

The manual Blacklist is for IPs that shouldn’t ever be able to talk to your site — not just “temporarily locked out after failed logins” but “we do not want this address, period.”

Reviewing and Clearing Active Lockouts

The Active Lockouts & Permanent Bans table is auto-populated by brute-force protection — you can’t add entries here manually, only clear them.

Each row shows:

• IP Address — the blocked address
• Status — yellow “Temporary” badge or red “Permanent” badge
• Lockouts — how many times this IP has been temporarily locked out (once it hits your Permanent Ban Threshold, the next lockout escalates to permanent)
• Reason — the string from the brute-force module, usually Brute force attempt detected — N failed login attempts for temporary blocks or Permanently banned after N temporary lockouts for escalations
• Blocked At — when the current block was recorded
• Expires — UTC timestamp for temporary blocks; Never for permanent bans
• Action — Unblock button clears the row immediately

To unblock a legit user who got caught:

Importing and Exporting IP Lists

The Whitelist and Blacklist can be exported as a single JSON file and re-imported into another site — useful when you run multiple sites and want to keep known-bad or trusted IPs in sync.

Export

Import

Locked Yourself Out via the Manual Blacklist

If you accidentally added your own IP to the manual Blacklist — or you added a range that turned out to include your IP — wp-admin will refuse to load. Unlike Emergency Lockdown, there’s no wp-config bypass constant for manual Blacklist. Recovery paths, in order of convenience:

• Sign in from a different IP. Phone hotspot, VPN, or work network. The Blacklist is per-IP; a different address gets through. Once in, remove your normal IP from the Blacklist.
• Ask another admin. If you’re on a multi-admin site, someone else can remove you from the Blacklist in ten seconds.
• Delete the Blacklist row from the database. Via phpMyAdmin, WP-CLI, or MySQL:

  # WP-CLI (adjust for your table prefix)
  wp option get guardpress_ip_blacklist --format=json
  
  # Then edit the returned JSON to remove your IP and set it back:
  wp option update guardpress_ip_blacklist '["OTHER.IP.HERE"]' --format=json

  Or use SQL directly:

  SELECT option_value FROM wp_options WHERE option_name = 'guardpress_ip_blacklist';
  -- Edit the serialized array and:
  UPDATE wp_options SET option_value = '<new-serialized-array>'
  WHERE option_name = 'guardpress_ip_blacklist';

  WP-CLI is much less error-prone than raw SQL because you don’t have to hand-write PHP-serialized data. If you don’t have WP-CLI, use phpMyAdmin.

• Deactivate GuardPress from wp-cli or by renaming the plugin folder. Nuclear option: wp plugin deactivate guardpress from CLI, or SFTP-rename the wp-content/plugins/guardpress folder. Neither of these deletes your settings — the lists persist and re-take effect when you reactivate. Once you have wp-admin access, fix the Blacklist and reactivate.

Common Mistakes

Confusing the auto-lockout table with the manual Blacklist

The Unblock button in Active Lockouts clears the auto-populated lockout row. It doesn’t remove the IP from the manual Blacklist if you also added it there separately — you have to remove it from the Blacklist too. Two separate tables, two separate clicks.

Whitelisting an IP that’s shared across an office pool

If your office has a NAT pool that hands out addresses across a shared /28, whitelisting only your specific momentary IP will stop working the next time DHCP hands you a different one. Ask your IT for the CIDR range of the pool and whitelist that instead. Or just whitelist your IP once and add the others as you encounter them.

Blacklisting a Cloudflare edge IP

Not really a mistake on your end — a diagnostic reminder. If GuardPress isn’t correctly detecting real visitor IPs (pre-1.6.30 or a misconfigured proxy header), you might end up looking at your firewall logs and seeing lots of “attacks” from Cloudflare’s edge IPs. Don’t blacklist those — you’ll block a chunk of the internet from reaching your site. Fix the real-IP detection first (see Country Blocking and the Cloudflare Real-IP Gotcha).

Not whitelisting uptime monitors

Services like UptimeRobot, Better Uptime, StatusCake hit your site every 60–300 seconds. If they fail a request and start retrying quickly, they can trip your rate limit and end up temporarily locked out — and then your uptime monitor shows the site as “down” because it can’t reach it. Whitelist your monitor’s published IP ranges once and forget about it.

Importing a Blacklist from a different site type

A Blacklist that made sense for a US-only membership site might block half of your international WooCommerce customers if you import it wholesale into a global store. Curate the import file before applying it — delete country-wide ranges that don’t apply to the new site’s audience.

Still Stuck? Email Priority Support

If IP Management is behaving unexpectedly — whitelisted IPs still getting blocked, CIDR ranges not matching, imports failing to apply, or the wrong IPs showing in the Active Lockouts table:

Email support@royalplugins.com with the diagnostic info below. Priority email support is included with your GuardPress Pro license — typical response time is within 24 hours.