# Accept Application Passwords Only From Trusted IP Addresses

> Rejects REST API and XML-RPC logins made with application passwords unless they come from the IP addresses or networks you list, such as your office, CI server or integration partner.

- Type: PHP
- Runs: Run everywhere
- Category: [Security](https://wpide.com/library/category/security/)
- Tags: application-passwords, api, ip-allowlist
- Author: WPIDE Team
- Installs: 0
- Updated: 2026-10-28
- Page: https://wpide.com/library/sec-application-password-ip-allowlist/

## Code

```php
// IP addresses or IPv4 CIDR ranges allowed to use application passwords.
$wpide_app_pass_ips = array( '127.0.0.1' );

$wpide_ip_allowed = function ( $ip ) use ( $wpide_app_pass_ips ) {
    foreach ( $wpide_app_pass_ips as $rule ) {
        if ( $rule === $ip ) {
            return true;
        }
        if ( false !== strpos( $rule, '/' ) && filter_var( $ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4 ) ) {
            list( $subnet, $bits ) = explode( '/', $rule, 2 );
            $mask = -1 << ( 32 - (int) $bits );
            if ( ( ip2long( $ip ) & $mask ) === ( ip2long( $subnet ) & $mask ) ) {
                return true;
            }
        }
    }

    return false;
};

add_filter( 'wp_authenticate_application_password_errors', function ( $error ) use ( $wpide_app_pass_ips, $wpide_ip_allowed ) {
    $ip = isset( $_SERVER['REMOTE_ADDR'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ) ) : '';

    if ( $wpide_app_pass_ips && ! $wpide_ip_allowed( $ip ) ) {
        $error->add( 'wpide_app_pass_ip', 'Application passwords cannot be used from this IP address.' );
    }

    return $error;
} );
```

## Notes

Use single addresses or CIDR ranges like 198.51.100.0/24; leave the list empty to allow every address.

## How to use it

Install the free WPIDE plugin (https://wordpress.org/plugins/wpide/), find "Accept Application Passwords Only From Trusted IP Addresses" in its snippet library and add it in one click; or create a new PHP snippet in WPIDE (or any code snippets plugin) and paste the code above. More snippets: https://wpide.com/library/