I'm working on a site based on a server with quite strict firewall rules. It won't allow anything running on the site to connect an external server unless its IP address is explicitly whitelisted.

Does anyone know where to find the IP address(es) of the WordPress core updater?


  • There's an old duplicate question here, but that doesn't have an authoritative answer.
    – Rup
    Oct 5, 2020 at 14:22
  • In fact you've virtually copied the first paragraph from that question so you must have already seen it? What's going on here?
    – Rup
    Oct 5, 2020 at 14:23
  • This address can be a subject to chage time to time, use nslookup downloads.wordpress.org to check an actual one. Oct 5, 2020 at 14:48
  • Yes, its because the question and the answers are since 2015. Are these IPs are still the same? I need updated information.
    – tw8sw8dw8
    Oct 5, 2020 at 14:48
  • I think you're going to have to ask wordpress.org directly for an authoritative answer. You could also try asking your web host if they'll give you a restricted proxy instead, that will allow access to a fixed list of hostnames including downloads.wordpress.org.
    – Rup
    Oct 5, 2020 at 22:04

1 Answer 1


Just checked and the IP right now is:

Do you want an programmable-in-php way to do it? You could run this on a WP-Cron schedule (adding some code) to check if the IP has changed at all and change it in your firewall if so while deleting the old IP (or use a hook to update the whitelist right before the major update calls all to download the zip). The code will only be as hard as how to whitelist things in your firewall. Hopefully it's something like:

$whitelist_ip = gethostbyname('downloads.wordpress.org');

Obviously the add_to_whitelist function is hypothetical (a function that either already exists, or you'd need to write) because adding an IP to a firewall depends entirely on what kind of firewall you're using which you may want to edit your original question to explain your firewall and how you add IPs to it.

  • I'd be very surprised if this add_to_whitelist function existed for OP, i.e. I doubt that a host with a strict firewall would let a machine behind the firewall edit its own settings.
    – Rup
    Oct 5, 2020 at 22:03
  • They didn't specify if it was a WP Firewall (which might have a function) or server firewall (which may have an API). They may have literally just been asking for the IP itself - which is my personal guess and why I put it at the top.
    – Lonkelle
    Oct 6, 2020 at 3:45
  • It is the Cloudflare firewall.
    – tw8sw8dw8
    Oct 6, 2020 at 9:18
  • Then what you want to do is possible to automate. You'd just have to use the code above and write a add_to_cloudflare_whitelist ($whitelist_ip) to add that IP to Cloudflare's firewall using their API. Documentation is here: api.cloudflare.com - hope that helps. ☺️
    – Lonkelle
    Oct 7, 2020 at 16:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.