Accept Application Passwords Only From Trusted IP Addresses
Rejects REST API and XML-RPC logins made with application passwords unless they come from the IP addresses or networks you list, such as your office, CI server or integration partner.
Opens WPIDE on
Code
// IP addresses or IPv4 CIDR ranges allowed to use application passwords.
$wpide_app_pass_ips = array( '127.0.0.1' );
$wpide_ip_allowed = function ( $ip ) use ( $wpide_app_pass_ips ) {
foreach ( $wpide_app_pass_ips as $rule ) {
if ( $rule === $ip ) {
return true;
}
if ( false !== strpos( $rule, '/' ) && filter_var( $ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4 ) ) {
list( $subnet, $bits ) = explode( '/', $rule, 2 );
$mask = -1 << ( 32 - (int) $bits );
if ( ( ip2long( $ip ) & $mask ) === ( ip2long( $subnet ) & $mask ) ) {
return true;
}
}
}
return false;
};
add_filter( 'wp_authenticate_application_password_errors', function ( $error ) use ( $wpide_app_pass_ips, $wpide_ip_allowed ) {
$ip = isset( $_SERVER['REMOTE_ADDR'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ) ) : '';
if ( $wpide_app_pass_ips && ! $wpide_ip_allowed( $ip ) ) {
$error->add( 'wpide_app_pass_ip', 'Application passwords cannot be used from this IP address.' );
}
return $error;
} );Notes
Use single addresses or CIDR ranges like 198.51.100.0/24; leave the list empty to allow every address.
How to add this snippet
- Install WPIDE on your WordPress site (it is free) and open Code Snippets.
- Use snippet above adds it from the library in one click. Or copy the code into a new snippet with the same code type.
- It is added inactive: review the code and settings, then switch it on.