{"id":614,"date":"2026-07-01T03:28:38","date_gmt":"2026-07-01T03:28:38","guid":{"rendered":"https:\/\/brutefort.com\/blog\/how-to-block-ip-address-wordpress\/"},"modified":"2026-07-15T13:47:21","modified_gmt":"2026-07-15T13:47:21","slug":"how-to-block-ip-address-wordpress","status":"publish","type":"post","link":"https:\/\/brutefort.com\/blog\/how-to-block-ip-address-wordpress\/","title":{"rendered":"How to Block an IP Address in WordPress (And Whitelist Trusted Ones)"},"content":{"rendered":"\n
\"Firewall
Photo by Pixabay from Pexels<\/figcaption><\/figure>\n\n\n\n

The same IP address keeps showing up in your login logs, hour after hour, even after a lockout period ends. That’s not bad luck. It’s a persistent attacker who already found your site and isn’t giving up after one timeout.<\/p>\n\n\n\n

Every site with a public login page deals with this eventually. Temporary rate limiting alone won’t stop an IP that just waits out the clock and comes back.<\/p>\n\n\n\n

This guide covers how to permanently blacklist an IP using BruteFort’s IP Settings panel, how to whitelist your own IP so you’re never locked out of your own site, and when to reach for geo-blocking instead of blocking IPs one by one.<\/p>\n\n\n\n

Quick Answer:<\/strong> Go to BruteFort \u2192 Settings \u2192 IP Settings<\/strong>, choose BlackList<\/strong> from the dropdown, enter the offending IP address, and click Add<\/strong>. The block takes effect immediately and stays until you remove it. Add your own IP under WhiteList<\/strong> first, so none of your blocking rules can ever lock you out.<\/p>\n\n\n\n

When to Block an IP Address in WordPress<\/h2>\n\n\n\n

Temporary lockouts from rate limiting handle the routine automated traffic. Permanent IP blocking makes sense in these situations:<\/p>\n\n\n\n

  • The same IP appears repeatedly in your BruteFort login logs after each lockout expires \u2014 a sign of a persistent attacker rather than opportunistic bot traffic<\/li>
  • You’ve confirmed via a lookup service like AbuseIPDB that the address is associated with known malicious activity<\/li>
  • Suspicious IP activity appeared in your logs around the time your WordPress site was hacked or compromised<\/li>
  • A specific IP is generating repeated requests that consume server resources even outside of login attempts<\/li><\/ul>\n\n\n\n

    How to Block an IP Address with BruteFort<\/h2>\n\n\n\n

    BruteFort’s IP Settings tab manages both blacklisting and whitelisting from a single interface. Here’s the process:<\/p>\n\n\n\n

    1. Go to BruteFort \u2192 Settings \u2192 IP Settings<\/strong><\/li>
    2. In the Choose Option<\/strong> dropdown, select BlackList<\/strong><\/li>
    3. Enter the IP address in the IP Address<\/strong> field (e.g. 45.123.221.24<\/code>)<\/li>
    4. Click Add<\/strong><\/li><\/ol>\n\n\n\n
      \"BruteFort<\/figure>\n\n\n\n

      The IP is now permanently blocked from your WordPress login page. It appears in the table below with its type (Blacklist), address, and date added.<\/p>\n\n\n\n

      Note:<\/strong> You can search and filter this table by type or IP, and delete any entry to unblock an address at any time.<\/p>\n\n\n\n

      \n