Protecting Your Admin Panel

To restrict admin paths like /admin or /wp-admin to your team’s IP addresses, first create an IP list, then write a rule that blocks everyone not on that list.

Step 1: Create an IP list

1. Open Console → WAF → [domain] → Rules → IP Lists.

2. Click New List:

   • List name: office-ips (3–16 characters, alphanumeric, - and _)
   • Items: one IP or CIDR block per line (up to 256 items)

   203.0.113.10
   198.51.100.0/24

3. Save the list.

Step 2: Write the block rule

1. Follow Console → WAF → [domain] → Rules → New Rule.

2. Combine two conditions with Add Condition (AND):

   • Field: Path (without query) (http.request.base_uri) · Operator: starts with (has_prefix) · Value: /admin
   • Field: IP List (ip.list) · Operator: not in list (not_in) · Value: office-ips

   # Allow admin panel access only from listed IPs
   IF   http.request.base_uri has_prefix /admin
   AND  ip.list not_in office-ips
   THEN block

3. Select Block as the action (or CAPTCHA for softer protection) and save.

Don't lock yourself out

If you work from home or a mobile network, your IP address can change. With a dynamic IP, prefer the CAPTCHA action over Block: someone not on the list can still get in by passing the challenge, while automated attacks are still stopped. Alternatively, make sure your current IP is on the list before saving the rule.

Rule order matters

Rules are evaluated top to bottom. If an earlier allow rule also covers the admin path, this rule never runs. Drag the admin protection rule above any broad allow rules in the rule list.

Alternative: single IP without a list

If you only have one static IP, you can skip the list and use the ip.src field:

# Block admin access except from a single IP
IF   http.request.base_uri has_prefix /admin
AND  ip.src != 203.0.113.10
THEN block

Verification

• Try accessing /admin from a network not on the list (e.g. your phone’s mobile data); you should see the block page.
• Confirm access works normally from a listed IP.
• Watch the rule’s hit counter on the Rules page; if it climbs unexpectedly fast, you may be blocking legitimate traffic too.

Related Pages

IP ListsManaging named IP lists

Trusted IP ExemptionsDefining broad exemptions for known IPs