Usage

IP Allowlist

The IP allowlist exempts addresses from every check: no rate counting, no scoring, no bans and no log entries. It is managed on Admin > Traffic Guard > Rules (/admin/traffic-guard/rules) under IP Allowlist, and any site admin or global admin can add or remove entries.

The allowlist is consulted first, before the ban check, so an allowlisted IP is let through even if it has an active ban.

Automatic exemption of private ranges

With Automatically skip checks for private/loopback IP ranges on (the default), addresses that PHP classifies as private or reserved are exempt without any entry: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8, 169.254.0.0/16, ::1, fd00::/8 and similar. Turn the setting off if your proxy sits on a private address and you trust X-Forwarded-For, or if you want to test the module from a local network.

Adding an entry

  1. Go to Admin > Traffic Guard > Rules and scroll to Add to Allowlist.
  2. Enter an IP Address or CIDR:
    • a single address, such as 203.0.113.5 or 2001:db8::1, or
    • a range in CIDR notation, such as 203.0.113.0/24 or 2001:db8::/32. IPv4 and IPv6 are both supported. The address part must be a valid IP; the prefix length is checked when matching (0 to 32 for IPv4, 0 to 128 for IPv6).
  3. Optionally add a Label such as Office network (up to 128 characters).
  4. Click Add to Allowlist.

Each entry must be unique; adding a duplicate shows Could not add entry (it may already exist).

Removing an entry

In the IP Allowlist table, click Delete on the entry's row and confirm. The address is subject to normal checks from the next request.

What to allowlist

  • Your own office or home addresses, so that administrators are never throttled or banned.
  • Uptime monitors and health checkers, which often poll a page every minute with a minimal user agent.
  • Search engine crawlers, if you prefer IP-based exemption over a user-agent allow rule (see User-Agent Rules).
  • Partner systems that use the JSON API heavily.

Prefer narrow entries. A single wide range such as 0.0.0.0/0 matches every address and switches protection off for everyone.

Log in for Support