Access Control

Overview

Access Control is ArmorPro's centralized IP management system. It combines an IP whitelist, a permanent blacklist, and country-based access control into a single interface. All access control settings are managed from the Access Control tab.

Priority order

When a request comes in, ArmorPro checks access rules in the following order:

1. Whitelist — If the IP is whitelisted, all security checks are bypassed. The request proceeds immediately.
2. Blacklist — If the IP is blacklisted (and the entry has not expired), the request is blocked.
3. Temporary blocks — If the IP has an active brute force lockout, the request is blocked.
4. Normal checks — Firewall patterns, country blocking, and other security rules are applied.

This priority order means whitelisted IPs are always allowed through, regardless of any other rules.

Whitelist

Whitelisted IPs bypass all ArmorPro security checks, including brute force protection, the firewall, bot protection, and country blocking. Use the whitelist for your own IP addresses, trusted team members, and any services that need uninterrupted access.

Adding IPs

Enter a single IP address in the whitelist input field and click Add. The IP is immediately active and will bypass all security checks.

Inline notes

Each whitelist entry supports an optional note (up to 100 characters). Click the note area to edit it inline. Use notes to identify who or what the IP belongs to, such as "Office VPN" or "Jane - remote".

Managing entries

The whitelist shows the first 20 entries by default. Click Load More to see additional entries. Each entry has a delete button to remove it from the whitelist.

You can also quickly whitelist IPs from the Brute Force login activity log by clicking the Whitelist IP action on any log entry.

Blacklist

Blacklisted IPs are permanently blocked from accessing your site. They receive a 403 Forbidden response on every request.

Adding IPs

Enter an IP address in the blacklist input field. You can optionally set an expiry date, after which the entry is automatically removed. If no expiry is set, the entry is permanent.

Inline notes

Like the whitelist, each blacklist entry supports inline notes (up to 100 characters). IPs that were auto-blacklisted by brute force or firewall rules show an automatic note such as Auto: 5 blocks indicating how many security events triggered the blacklist entry.

Country detection

Each blacklisted IP automatically shows its detected country and country code based on GeoIP lookup. This helps you identify geographic patterns in malicious traffic.

Managing entries

The blacklist shows the first 10 entries by default, with a Load More button that loads 20 additional entries at a time. Each entry has a delete button, and a Clear Entire Blacklist option is available for bulk removal.

Protected IPs

Private and localhost IP addresses are never blacklisted, even if they trigger security rules. This includes:

• 127.0.0.1 (localhost)
• 192.168.x.x (private network)
• 10.x.x.x (private network)

Country blocking

Country blocking lets you restrict access to your site based on the visitor's geographic location. ArmorPro uses the MaxMind GeoLite2 database for IP-to-country lookups.

Blocking modes

Country blocking supports two modes:

• Block mode — Block visitors from the listed countries, allow everyone else. Use this when you only need to block a few specific countries.
• Allow mode — Allow visitors from the listed countries only, block everyone else. Use this when your site serves a specific geographic region.

Country picker

The country picker provides a searchable dropdown with country flags. Type a country name to filter the list, then click to add it. Selected countries appear as tags that can be individually removed.

Blocked country response

Visitors from blocked countries receive a 403 Forbidden response. The Dashboard displays a daily counter showing "Country Blocks Today" so you can monitor the impact of your country rules.

GeoIP database

Country blocking and geographic lookups throughout ArmorPro rely on the MaxMind GeoLite2 database. The database is managed automatically:

• Auto-download — The GeoIP database is automatically downloaded the first time a feature requires it (country blocking, login activity log location, blacklist country detection).
• Weekly updates — A WordPress cron job automatically downloads a fresh copy of the database every week to keep country data accurate.
• Manual download — A button in ArmorPro → Settings lets you manually trigger a database download at any time.