Skip to content
Avaloi

IP deny

Block an IP address or range at the edge and at the server, allow an address through a blocked range, and avoid locking yourself out.

IP deny blocks traffic from an address or a range before it reaches WordPress. Open your site, then IP deny, to manage the list for the environment you are looking at. Avaloi enforces the list at Cloudflare and again on your site's web server.

Cloudflare rules for every site share Avaloi's Cloudflare plan, which allows a set number of firewall rules. When they are full, the tab says so and your list is enforced by the web server alone. Blocked visitors still never reach WordPress.

Block an address or range

  1. Open your site, then IP deny.
  2. Choose Add IP addresses.
  3. Enter one address, or a range in CIDR form such as 203.0.113.0/24, per line.
  4. Add a note so your team knows why, then choose Add.

Avaloi applies the rule through a job. Requests from that address or range are blocked at the edge and at the server.

Allow an address through a blocked range

Add the address with the type Always allow these addresses. An allow entry wins over a deny range that contains it, so you can block a whole network and still let one address in.

Add your current IP

In the add dialog, Add my IP address fills in the address you are using now. Use it to allow your own address before you block a range that contains it.

Avoid locking yourself out

Avaloi warns before it blocks your own address, because that locks you out of the site. Confirm only if you mean it. Through the API, a rule that would block the address you are calling from is refused unless allow_self_lockout is true.

Replace the whole list

Tick several entries and choose Remove to remove them together. The dashboard adds and removes entries in one job by replacing the whole list, and you can do the same through the API.

Limits

  • Ranges wider than a /8 for IPv4 are refused.
  • Ranges wider than a /32 for IPv6 are refused.
  • An environment holds up to 1,000 entries.

Quick answers

I blocked myself. How do I get back in? Connect from another address or network, open IP deny, and delete the rule. If you cannot, contact support.

Does a rule block the whole site or one environment? One environment. Add the rule on each environment you want to protect.

Can I block a country? No. IP deny works on addresses and ranges. Bot protection handles automated traffic in general.

Why was my range refused? It was wider than the limit: /8 for IPv4 or /32 for IPv6. Split it into smaller ranges.

API

  • GET /v1/environments/{id}/ip-rules
  • POST /v1/environments/{id}/ip-rules
  • PUT /v1/environments/{id}/ip-rules
  • DELETE /v1/environments/{id}/ip-rules/{rule_id}

Still stuck?

Email [email protected] with your site name and what you tried, or send us a message.