Administration Guide

How to restrict Site access by IP address

Use an IP allowlist to limit sign-in to the current Site to trusted addresses and networks. By default, users can sign in only from addresses in the allowlist, while non-interactive clients remain exempt. You can apply the same restriction to non-interactive clients if required. This setting applies only to the current Site.

Admin Center > Security > Access restrictions

Prerequisites

  • You are signed in as a Site Administrator.
  • You know your current IP address and the addresses or networks that require access to the Site.
  • You have decided whether non-interactive clients should be subject to the allowlist.

IMPORTANT: Plan the allowlist before enabling the restriction. Include your current IP address and the addresses used by other users who require access. AlloyScan does not save an enabled, non-empty allowlist that excludes your current IP address.

Supported entries

Enter one entry per line. The allowlist accepts:

  • individual IPv4 and IPv6 addresses
  • networks in CIDR notation
  • IPv4 address ranges

Lines beginning with # are comments.

Configure the allowlist

  1. Open Admin Center > Security > Access restrictions.
  2. Enable Restrict access by IP address.
  3. Enter the addresses and networks that can access the Site. Make sure the list includes your current IP address.
  4. Review Exempt non-interactive clients from IP restrictions.
  5. Click Save.

If the enabled allowlist does not include your current IP address, AlloyScan rejects the change and identifies the address that must be included.

Choose whether to exempt non-interactive clients

Exempt non-interactive clients from IP restrictions is selected by default when you enable Restrict access by IP address.

Non-interactive clients include:

  • Audit Agents, Audit Services, and their updaters
  • internal registration clients used by AlloyScan
  • API clients that use app registrations to access the AlloyScan API

When the option is selected, these clients bypass the allowlist. When the option is cleared, the allowlist also applies to them.

IMPORTANT: If you clear this option, non-interactive clients can connect only from addresses in the allowlist. Add the source IP addresses or networks for all required clients before saving. AlloyScan also warns you about the risk of blocking these clients.

Verify access

  1. Reopen Admin Center > Security > Access restrictions and confirm that Restrict access by IP address is enabled and the allowlist contains the saved entries.
  2. From a device whose IP address is included in the allowlist, sign in to the Site.
  3. If possible, attempt to sign in from an IP address that is not included in the allowlist and confirm that access is denied.
  4. Open Admin Center > Logs > Security log and review the denied access event.
  5. If non-interactive clients are not exempt, verify that required clients can still connect from allowed addresses:
    • Check recent Last active values under Admin Center > Tasks and services > Audit agents and Audit services.
    • Send a test request through each required API integration.