Restricting wp-admin to a specific set of IP addresses means the login page itself doesn’t even respond to anyone outside that list, regardless of whether they have a valid password — a strong extra layer if your team logs in from a small, predictable set of locations, and a poor fit if they don’t.
wp-admin IP restriction & access control
wp-admin restricted to your team's known IP addresses, with a documented way back in.
- Full backup taken before we start
- If we can’t fix it, you get your money back
- We never ask for your own password
What we need from you
- FTP or hosting access to implement the restriction at the server level
- A confirmed, complete list of IP addresses that should retain access
- Confirmation of whether any team members work from variable or changing locations, since that affects whether this approach fits
This or something else?
| Your team logs in from a small, known set of locations and you want wp-admin restricted to them | This fix covers it |
| Your team’s IP addresses change frequently (remote work, mobile, travel) | This approach may not fit well — worth discussing alternatives like 2FA or login limiting instead |
| You want login attempts limited rather than access restricted by location | Login attempt limiting & brute force protection, a better fit for variable locations |
| You’re locked out after a similar restriction was set up incorrectly | Login redirect loop fix, or describe the specific lockout to us directly |
What we do
- Confirm the complete, current list of IP addresses needing access
- Implement the restriction at the server or .htaccess level, not just a plugin setting that can be bypassed
- Test access from an approved address to confirm it still works
- Test that access from an unapproved address is genuinely blocked
- Document how to add a new IP address later if your team’s locations change
- Provide a safe fallback method in case of a future lockout
What is included
- wp-admin access restricted to your specified IP addresses
- Tested confirmation both approved and unapproved access behave correctly
- A documented fallback method to avoid permanent lockout
- A written note on how to update the list later
Not included
- Ongoing updates to the IP list as your team’s locations change
- Two-factor authentication, a complementary but separate fix
- Broader login security like attempt limiting, a separate layer
- Recovering from a lockout caused by a change made outside this fix
Questions about this fix
What happens if I need to log in from a new location later?
You'd need the new IP address added to the approved list — we document exactly how to do this so it's not a support request every time, though it does require action each time your access pattern changes.
Is this a good fit if my team works remotely from different places?
Generally not on its own — this works best with a small, stable set of locations; frequently changing IP addresses make this approach more disruptive than protective, and other layers fit better.
What if I get locked out by mistake after this is set up?
We build in a documented fallback method specifically to avoid a permanent lockout, though it does require having planned for that scenario in advance.
Does this replace the need for a strong password or two-factor authentication?
No — it's an additional layer restricting who can even reach the login page, not a replacement for authentication itself once someone does reach it.
Can this be combined with a VPN if my team's actual location varies but their VPN exit IP doesn't?
Yes, that's a common and effective approach — restricting to a consistent VPN exit IP gives you the stability this fix needs even with a physically distributed team.
Related fixes
If this is the second time this year
A bad update breaking the site is a symptom of updates not being tested first. Care plans run every update on a staging clone before it reaches your live site, which is the actual fix for this happening again.
Your access, your rules
Create a separate admin account for us and delete it when we are done. For anything else, we get in touch and agree a method — never a form field on this site, never by reply to an email.
We back up first, always
Before anything is touched we take a full backup and keep it for 30 days. If a fix goes wrong, we put the site back exactly as it was.
If it is not what you bought
If the problem turns out smaller than what you ordered, we refund the difference. If it is bigger, we stop and send a quote before doing any extra work.
If we cannot fix it
You get back what we received. Diagnosis is on us — you only pay when the problem is actually solved. The payment processor takes its fee before the money reaches us, so we never hold it and it is not ours to return. That is true here as everywhere else.
If it comes back
Reply within seven days of delivery and we put it back on the bench at no cost. The fix is not finished until it holds.
What we are responsible for
If something goes wrong with a fix, our responsibility is limited to what you paid for it. We take a full backup first so mistakes can be undone, and we tell you before doing anything outside what you bought.