Magento blacklist and whitelist are part of Magento security best practices aimed at preventing suspicious IP addresses from generating spam, scraping data or simply overloading your server. Blocking malicious IP addresses helps to reduce spam and protect your store, while whitelisting real visitors, developers, or trusted crawlers.
Magento doesn't offer any IP blocking features by default, so blocking specific IP addresses in Magento (or IP ranges) usually requires a CDN, server or Magefan's Extension.
This guide walks you through Magento blacklist and whitelist settings available directly in the admin panel.
What Are Magento IP Blacklist and Whitelist?
Magento IP blacklist blocks specific IP addresses from accessing a Magento 2 store, while IP whitelist allows trusted IP addresses to enter a website. Both restriction methods allow merchants to control who or what can access their Magento stores and can be used in different scenarios: rate limiting, temporary or permanent blocking, etc.
Magento 2 IP blacklist is a list of IP addresses that should be denied access to a website. It is usually when visitors or bots are generating spam, scraping content or engaging in suspicious activity like sending excessive requests.
Magento 2 IP whitelist is a list of trusted IP addresses, e.g. developers, employees and services that should be allowed access.
| IP rule | What it does | Use case |
|---|---|---|
| IP blacklist | Blocks specific IP addresses | Stop suspicious bots from scraping and abusive traffic |
| IP whitelist | Allow specific trusted IP addresses | Protect Magento admin and frontend access and allow trusted sources |
| IP range | Blocks/allows multiple IP addresses | Block/allow traffic from a knows network |
Merchants can apply IP restrictions in Magento at different levels — server, CDN, firewall or Magento admin directly — depending on how they want bot traffic to be stopped and monitored.
e.g. blocking a malicious IP address at the server or CDN level requires deep technical knowledge and is not easy to manage, while a Bot Blocker extension enables admins to monitor and create IP blocking rules directly from the admin.
When Should You Blacklist an IP?
Blacklist IPs whenever you spot suspicious activity from a specific source that is not likely performed by a real user:
- A bot generates automated search queries or layered navigation filters.
- An IP address sends repeated server requests.
- A bot attempts creating customer accounts with fake email addresses.
- Repeated unauthorised access attempts from a malicious IP.
Note: you can track suspicious login activity in Magento admin directly using the .
Example of the Magento login log in the Magefan extension
Blacklisting is a better option if you need to restrict access to a small number of IPs while the majority of visitors should remain allowed. Avoid blacklisting based on a single IP request since multiple users might appear under the same IP address because of proxy services, VPNs or shared networks. You don't want to block these.
When Should You Whitelist an IP?
Since IP whitelisting is more restrictive and can cause access issues, use it only to guarantee access to trusted sources such as:
- Store admins accessing the backend.
- Employees connecting from our site or your trusted network.
- Developers you allow to work on your store.
- Trusted monitoring or legal services.
Note: it's best to use an IP blacklist in Magento if you want to protect your store from bot traffic, since IP whitelists (especially when used with dynamic IPs) can accidentally allow unwanted traffic.
How to Block IP Address in Magento 2?
To block specific IP addresses in Magento, add a specific address to the IP blacklist using the server, CDN or via access lists directly in the admin panel and test the rules. With Magefan Bot Blocker, you can manage the IP blacklist directly from the admin panel manually, or it just blocks suspicious IPs automatically based on configured rules.
Step 1: Blacklist IP address
Navigate to Stores > Configuration > Magefan Extensions > Bot Blocker > Access Lists. Then specify the IPs or entire subnets you want to block in the Blocked IPs field and save the settings.
IP blacklist option in Magefan Bot Blocker
Step 2: Test the blacklist (optional)
Important: it's best to do the testing using a test IP through a VPN, so that you can regain access to your website after disabling the VPN and unblocking your IP.
To test how the Magento IP blacklist works, enter your or test IP in the Blocked IPs section. Then move to Stores > Configuration > Magefan Extensions > GeoIP Database > Developer (Simulate Geolocation), paste it in the Allowed IPs field and specify the Simulate Country.
This creates an environment in which your IP is recognised as a visitor from that IP and country to allow you to test how the IP blocking works.
Magefan location simulator for testing IP restriction rules
The system should make a website unavailable for you immediately after you hit Save.
Blocked access message shown on frontend once the IP is blocked
Note: don't forget to clear the Allowed IPs field in the location simulator, in order not to block access to the admin for your employees, if you're testing it with your store IP.
Step 3: Monitor blocked IPs
After you block a suspicious IP, monitor how Magefan Bot Blocker blocks it via System > Bot Blocker > Traffic Monitor > Top IPs.
Alternatively, navigate to the bottom of the traffic monitor to view IPs and block them temporarily or permanently.
IP log of the blocked IPs by Magefan Bot Blocker
When Are Suspicious IPs Blocked in Magento Automatically?
Magefan Bot Traffic Monitor blocks IPs automatically based on multiple settings like rate limiting, bad request rule and, URL patterns and others to ensure complete spam protection for your store.
Let's review all settings available in the Bot Blocker that block suspicious IPs automatically because of malicious activity.
- DDoS protection — if an IP address exceeds the request limit within a monitoring window.
- Bad request rules — IPs running blocked body or URL pattern requests.
- URL patterns — user agents through IPs trying to access restricted URL patterns.
- User agent restrictions — blocked user agents trying to perform unauthorised actions.
- Search and layered navigation spam — agents generating search and layered navigation spam.
Example of the IP addresses blocked based on the bad requests rule (source: Magefan Bot Blocker)
How to Whitelist IP Addresses in Magento?
To whitelist an IP in Magento, navigate to Stores > Configuration > Magefan Extensions > Bot Blocker > Access Lists and add a trusted address to the Allowed IPs so it can access your store without being blocked.
IP whitelist in Magento admin
Note: Magefan Bot Blocker manages whitelisted IPs alongside blocking rules, rate limiting and reCAPTCHA. But whitelisted IPs have the highest priority.
Best Practices for Managing Magento IP Blacklists and Whitelists
The safest way to manage allowed and blocked IPs in Magento is to use specific IP rules and update them regularly. Blocking too many IPs or IP ranges can prevent real users from visiting a website, while relying on IP whitelisting is not completely reliable, especially with dynamic IPs.
Pro tip: if you want to allow all users to access but want to protect your store from malicious bots, enable Magento reCAPTCHA, which will block only suspicious IP activity.
Follow these best practices to manage IP restriction in Magento:
- Block specific IP addresses first — if you identify some abusive IPs, block them specifically, not an entire IP range, in order not to block legitimate users.
- Use multiple protection layers — don't rely on IP blocking alone, and combine it with other security measures like rate limiting, reCAPTCHA, search spam blockers and fake email registration protection.
- Keep a record of trusted IP addresses — have a list of IPs used by developers, remove employees, trusted systems and services, so they are added to the IP whitelist in Magento when necessary.
- Monitor traffic patterns before blocking IPs — don't block an IP address based on a single request. Monitor repeated requests, activity spam, sensitive page access requests and other pattern actions.
- Update blocked or whitelisted IPs regularly — verify existing IP rules to notice changes and update hosting providers, proxies or IP ownership to stay protected.
IP blacklisting and whitelisting in Magento is just one way to protect your website from malicious bots. Start with specific IP addresses after verifying suspicious activities and avoid blocking entire IP ranges, as this could affect real users.
However, bots and spam are not the only issue. There are also other security vulnerabilities in Magento attackers may exploit to gain access to your store data, customers, database and files. Make sure to use other rules for stronger protection.
FAQs
Can I block an IP range in Magento?
Does Magento 2 have a built-in IP blacklist?
How to temporarily block an IP in Magento 2?
How to permanently block an IP in Magento?
How to allow only certain IPs to access my Magento store?
