I have a website that is login required in order for users to view the website. I have set up one user for all internal members to use to view the website, however i want to limit just that user to our specific IP address.

I can see you can limit access site-wide to an IP address via htaccess, but i only need to implement it for one user, so they can only view the website from our IP address.

Is this possible?

  • Do you mean to "Exit login for everyone except for specific IP addresses?" – Samuel Elh Jul 28 '16 at 8:22
  • @SamuelElh The website forces a login in order to view the front-end (similar to a intranet sort of thing). But i want to be able to limit one specific user to logging in, unless they are at a specific IP address. So something like: For User ID 1, if IP Address = {{IP Address here}}, then allow login. If not, then dont allow login – Futwill Jul 28 '16 at 8:30
  • Try smth like this pastebin.com/6MYgCpLF, there's a custom hook that runs after user login which you can use. – Samuel Elh Jul 28 '16 at 10:07

IP address validation during authentication - for a selected user only

Here's a way to hook into the authenticate filter and validate the IP address for a given user during authentication.

The user can see the invalid IP address error like shown here:

invalid IP address

 * Validate IP Address During Authentication - For A Given User 
add_filter( 'authenticate', function( $user )
    // Adjust to your needs:
    $allowed_user_ip        = '';
    $ip_restricted_user_id  = 1;

    // Current user's IP address
    $current_user_ip = isset( $_SERVER['REMOTE_ADDR'] ) ? $_SERVER['REMOTE_ADDR'] : null;

    // Nothing to do for valid IP address
    if( $current_user_ip === $allowed_user_ip )
        return $user;

    // Nothing to do for users that are not IP restricted 
           $user instanceof \WP_User 
        && $user->ID > 0
        && $ip_restricted_user_id != $user->ID
        return $user;

    // Add an 'Invalid IP address' error
    if( is_wp_error( $user ) )
            '<strong>%s</strong>: %s',
            esc_html__( 'ERROR', 'mydomain' ),
            esc_html__( 'IP address is invalid.', 'mydomain' )
    // Create a new 'Invalid IP address' error
        $user = new WP_Error(
                '<strong>%s</strong>: %s',
                esc_html__( 'ERROR', 'mydomain' ),
                esc_html__( 'IP address is invalid.', 'mydomain' )

    return $user;
}, 100 );

Here we use the priority of 100 because of these default callbacks:

add_filter( 'authenticate', 'wp_authenticate_username_password',  20, 3 );
add_filter( 'authenticate', 'wp_authenticate_email_password',     20, 3 );
add_filter( 'authenticate', 'wp_authenticate_spam_check',         99    );

It should be possible to extend this to handle a group of users or a given user role.

  • 1
    @Futwill if the answer from birgire did answer your question please make sure to mark it as the accepted answer. – DᴀʀᴛʜVᴀᴅᴇʀ Jul 28 '16 at 14:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.