IP rules (restrict downloads by network) Pro

IP rules restrict which networks can download from your library. There are two modes, and you pick one:

• Only these addresses may download — an allowlist. Useful when documents are not meant to leave the office, a VPN, or a customer’s network.
• Block these addresses — a denylist. Useful for shutting off a specific abusive source.

Set them under Documents → Settings → Downloads → IP rules.

Writing the list

One entry per line. Both IPv4 and IPv6 work, as single addresses or CIDR ranges:

203.0.113.4
198.51.100.0/24
2001:db8::/32

Anything that isn’t a valid address or range is ignored, so a stray line won’t silently disable the rest of the list.

What the rules cover

The check runs on the download route, which means it applies to:

• ordinary downloads from a library,
• zip downloads,
• and signed share links.

That last one is deliberate. An allowlist means "only these networks may fetch our files"; if forwarding a share link got around it, the control would be decorative. If you need a document to travel outside the network, take it out of the restricted library rather than relying on a link.

Two safety behaviours worth knowing

Site administrators are never blocked. <!– claim-ok: verified by the integration suite — "a site manager is never blocked by their own IP rules" –>A mistyped allowlist would otherwise lock you out of your own library with no way back in through the front end.

An allowlist with no addresses in it is treated as off. <!– claim-ok: verified by the integration suite — "an empty allowlist is treated as off, not as refuse-everyone" –>It reads as a half-finished setting rather than an instruction to refuse every visitor.

What it is not

IP rules are a network boundary, not an identity check. Addresses can be shared, spoofed at the edges, and changed by any visitor with a VPN. Use them alongside role and user restrictions or client areas when it matters who is downloading, not just where from.

If your site sits behind a proxy or CDN, make sure the real visitor address reaches WordPress — otherwise every visitor looks like the proxy.