← Waf / waf / custom-rules / use-cases

Require known IP addresses in site admin area

If an attack compromises the administrative area of your website, the consequences can be severe. With custom rules, you can protect your site's admin area by blocking requests for access to admin paths that do not come from a known IP address.

This example custom rule limits access to the WordPress admin area, /wp-admin/, by blocking requests that do not originate from a specified set of IP addresses:

• When incoming requests match:

  Field	Operator	Value	Logic
  IP Source Address	is not in	10.20.30.40 192.168.1.0/24	And
  URI Path	wildcard	/wp-admin/*

  If you are using the expression editor:
  (not ip.src in {10.20.30.40 192.168.1.0/24} and http.request.uri.path wildcard "/wp-admin/*")

• Then take action: Block

• Use case: Allow traffic from IP addresses in allowlist only