Block and allow lists you control
The block list is a deliberate decision, so it doesn't wait for Block mode. A listed address is refused even while the firewall is only monitoring. The allow list works the other way: an allowlisted address is never inspected by the firewall at all.
Both lists take single addresses or CIDR ranges, so an office network or a VPN can go in as one line. An entry written in IPv4-mapped form, such as ::ffff:1.2.3.4, matches its plain IPv4 spelling too.
Needs setup. Both lists start empty.
Why you should allowlist your own addresses
Put your office, your VPN and any fixed address your team works from on the allow list before you tighten anything else. An allowlisted address is skipped by the firewall rules, exempt from the sign-in lockout (including the lock on a single account), never given an attacker score and never reported to the network list.
That protects you from the one false positive that hurts most: your own team shut out mid-task. If it happens anyway, an emergency sign-in link can be emailed to administrator addresses, and the WPSG_FIREWALL_OFF constant turns the firewall off. More recovery options are on the login security page.
- Firewall rules: never inspected.
- Sign-in lockout: exempt.
- Attacker scoring: never scored.
- Network learning: never reported.
Needs setup. Add your own addresses to the allow list.
Country blocking for WordPress
Country blocking has two modes. A block list refuses the countries you name. An allow list refuses every country you didn't name, which is stricter, so check where your team travels and which outside services call your site before you choose it.
Countries are looked up in a DB-IP country database that is signed, refreshed monthly and downloaded with your licence. Jetpack and WordPress.com addresses are exempt from country rules, so those services keep working.
Country rules cut noise from places you don't serve. They don't stop a determined attacker, who can send traffic from any country.
Off by default. Needs a licence for the country database.
Automatic blocks
Some addresses block themselves by how they behave. The sign-in lockout stops password guessing: 5 failed tries in 15 minutes gives a 15-minute lockout, and 20 gives a 24-hour lock. Attack usernames such as admin or root that aren't real accounts are locked on the first try. The details are on brute force protection.
In Block mode, attacker scoring blocks an address for an hour once it reaches 20 points from at least 2 kinds of bad behaviour. Auto-block, a separate option, temporarily shuts out an address that keeps tripping the firewall.
The lockout is on by default. Attacker scoring is on for new installs. Auto-block is off by default and takes effect only in Block mode.
The signed attacker list
You don't have to find every bad address yourself. A signed list of known attacker addresses is downloaded daily and checked with Ed25519 before use. In Block mode, addresses from public threat feeds are refused. Also in Block mode, addresses that only other WP SecureGate sites reported are refused on sign-in, registration, password reset and a few other sensitive targets, not on ordinary page views.
How the list is built and where each kind of listing applies is covered on the WordPress firewall plugin page.
On by default. Needs an active licence.
Part of WP SecureGate: Firewall →