Clever Members 1.14.324 adds a Block IP Addresses section under Settings > Security and Legal. Administrators and Super Members can use it to block a single IP address or a whole range from opening any part of the website. A block takes effect right away, works behind Cloudflare and can’t be used to lock yourself out. When a member’s account is locked after three wrong passwords, every Administrator and Super Member now gets a notification in their bell showing who was locked out and from where, with a link to WordPress Users. When an Administrator or Super Member unlocks their own account from the emailed link, a “Was this you?” popup lets them block the IP addresses that tried to get in with one click.
Block IP Addresses
Settings > Security and Legal now has a new section called Block IP Addresses. It lets Administrators and Super Members stop a specific IP address, or a whole range of them, from opening your website. A blocked visitor sees a simple “Access denied” page instead of your pages, your login, your forms or your Admin Area.
You can block:
- One address, like 203.0.113.7
- A range, like 203.0.113.10 - 203.0.113.50
- A block of addresses, like 203.0.113.0/24
- Everything that starts with the same numbers, like 203.0.113.*
IPv6 addresses work too.
- It works right away. Type the address, add a note so you remember why you blocked it, and click Block. There’s no Save button to remember.
- You can see if it’s working. The list shows when each address was blocked, who blocked it, and how many times it has been turned away since.
- Every change is recorded. Adding or removing a block goes in the Activity Log.
You can’t lock yourself out. Clever Members shows your own IP address at the top of the section and won’t let you block it, even by accident inside a larger range.
It works behind Cloudflare. Many websites run behind Cloudflare, which hides the visitor’s real address from the website. Clever Members reads the real address Cloudflare passes along, so blocks apply to the right person. It only trusts that address when the request really comes from Cloudflare, so nobody can get around a block by faking it.
Your Team Knows When a Member Is Locked Out
Clever Members already locks an account after three wrong passwords in 15 minutes. That stops anyone who is trying to guess a password.
Until now, only the website’s main Administrator email heard about it. Now every Administrator and Super Member gets a notice in their notification bell:
- whose account was locked
- when it happened
- which IP address the wrong passwords came from
Click Open to go straight to WordPress Users. From there you can unlock the account if your member just forgot their password, or leave it locked and block the address if it looks like someone else was guessing.
Was This You?
When an Administrator or Super Member’s own account gets locked, they receive an email with a link to unlock it. Now, after they click that link, Clever Members asks: Was this you?
The popup lists the IP addresses the wrong passwords came from. If it wasn’t them, one click on Block These IP Addresses adds those addresses to the Blocked List, so whoever was trying to get in is shut out of the whole website.
- It works once. The button lasts 24 hours and then expires, so an old or forwarded email can’t be used later.
- It never blocks you. It skips the address the person is using at that moment.