How to Whitelist IP Address in Cloudflare
If you need to allow a trusted server, office network, monitoring tool, or developer IP through Cloudflare, the safest method depends on what you want to bypass.
This guide explains how to whitelist IP address in Cloudflare without weakening your security more than necessary.
Cloudflare does not use the term “whitelist” in every place, so the exact steps vary by product and plan.
The important part is choosing the right allow rule for the right layer: firewall, access control, or origin protection.
What it means to whitelist an IP in Cloudflare
Whitelisting an IP address in Cloudflare means allowing traffic from a specific IPv4 or IPv6 address to pass through security checks that would otherwise challenge, block, or filter it.
In practice, this may allow access to a website, dashboard, API endpoint, or origin server.
Cloudflare provides several mechanisms for this:
- Firewall Rules for allowing requests at the edge.
- IP Access Rules for quick allow or block decisions.
- Zero Trust Access policies for app-level authorization.
- Origin allowlisting to restrict who can reach your server directly.
Because Cloudflare sits in front of your origin, a whitelist can affect what visitors see at the edge, not just what your server receives.
When should you allow an IP address?
Allowing an IP address is useful when a trusted system is incorrectly challenged or blocked.
Common examples include payment gateways, uptime monitors, search engine bots, third-party integrations, office networks, and remote administrators.
It is also useful for troubleshooting access issues.
If a contractor or internal team member is repeatedly hitting security challenges, an IP allow rule can isolate whether Cloudflare filtering is the cause.
Common use cases
- Allowing a CI/CD server to deploy to a protected admin panel
- Permitting a monitoring service like Pingdom or UptimeRobot
- Allowing a fixed office IP to access WordPress or a staging site
- Exempting a trusted API consumer from rate-based blocks
- Creating temporary access for support or maintenance
How to whitelist IP address in Cloudflare using Firewall Rules
For many Cloudflare users, the most flexible approach is a Firewall Rule that allows requests from a specific IP before other security logic applies.
This is usually the best option when you want fine-grained control over a website or application.
Steps to create an allow rule
- Log in to the Cloudflare dashboard and select your domain.
- Open Security and then WAF or Firewall Rules, depending on the interface shown in your account.
- Create a new rule with a condition matching the IP address.
- Use a filter such as ip.src eq 203.0.113.10 for a single IPv4 address.
- Choose the action Allow if available, or Skip to bypass selected security features.
- Save and deploy the rule.
If your account uses the newer Cloudflare Ruleset Engine, you may see rule configurations under WAF, Custom Rules, or Rules.
The naming changes, but the logic is the same: match the IP and permit it.
When to use Allow versus Skip
Allow generally permits the matched request while still leaving some protections in place.
Skip can bypass specific security controls such as managed challenge, bot rules, or certain WAF inspections.
If you are whitelisting a trusted internal service, Skip may be appropriate; if you only want to reduce false positives, Allow is often safer.
How to whitelist IP address in Cloudflare with IP Access Rules
IP Access Rules are simpler and faster for one-off exceptions.
They are useful if you want Cloudflare to immediately allow a trusted IP across a zone, account, or specific subdomain scope, depending on your plan and configuration.
Steps to add an IP Access Rule
- Open the Cloudflare dashboard for the site.
- Go to Security and then WAF or Tools, where IP Access Rules may be located.
- Select IP Access Rules.
- Add the IP address, IP range, or CIDR block.
- Set the action to Allow.
- Choose the scope if prompted, such as the entire zone or a specific hostname.
- Save the rule.
This method is straightforward, but it is less expressive than custom firewall rules.
If you need to combine IP conditions with paths, user agents, or request methods, a custom rule is better.
Can you whitelist an IP range or subnet?
Yes.
Cloudflare supports IP ranges using CIDR notation, which is useful for office networks, cloud-hosted services, or VPN exit nodes with multiple addresses.
For example, a /32 is a single IPv4 address, while a broader subnet such as /24 covers a larger block.
Use caution with ranges.
A narrow range reduces risk, while a broad range may unintentionally permit traffic from devices you do not control.
Whenever possible, whitelist only the exact address or the smallest practical subnet.
How to allow IP access for Cloudflare Zero Trust applications?
If the resource is protected by Cloudflare Zero Trust, an IP allow rule may be part of an Access policy rather than a website firewall rule.
In that case, you create a policy that includes the source IP or network as an allowed condition.
This is common for internal applications, admin portals, and remote work access.
Instead of allowing the IP at the edge only, Zero Trust policies let you define who can reach an application based on identity, device posture, and network location.
Typical policy elements
- Include a source IP or IP range
- Combine with email identity or SSO login
- Restrict by device health or browser checks
- Set a specific application hostname
How to avoid common mistakes when allowlisting IPs
One common mistake is allowing an IP address that changes frequently.
Many home and mobile connections use dynamic IPs, so a rule that works today may stop working tomorrow.
If a user’s IP changes often, consider a VPN with a fixed exit IP or an identity-based access model instead.
Another mistake is over-permitting large IP ranges.
This can reduce the effectiveness of Cloudflare security features and create unnecessary exposure.
It is also easy to forget temporary access rules after maintenance is complete.
Best practices
- Prefer a single IP over a broad subnet whenever possible
- Document why the IP was allowlisted and who approved it
- Set reminders to review temporary rules
- Test access after deploying the rule
- Pair IP allowlisting with authentication for sensitive apps
How to test whether the IP is successfully whitelisted
After saving the rule, verify that the trusted IP can reach the protected resource without being blocked or challenged.
Test from the permitted network and from a non-permitted network to compare behavior.
You can also review Cloudflare security events to confirm whether the request matched the allow rule.
Logs may show whether the action was allowed, skipped, or challenged, which helps you validate the configuration.
What to check during testing
- Page loads without a browser challenge
- API requests return the expected status code
- Security events show the allow rule match
- Origin server logs reflect the expected visitor
Should you use IP whitelisting alone?
IP whitelisting is effective for trusted infrastructure, but it should not be the only security layer for important applications.
Static IP access can be spoofed less easily than identity, but it does not prove who the user is.
For sensitive systems, combine Cloudflare IP allow rules with MFA, SSO, device policies, or origin authentication.
For public websites, IP whitelisting is best reserved for specific use cases such as bots, internal staff, support teams, and monitoring services.
For broader user access, identity-based controls are usually stronger and easier to manage at scale.
Key takeaways for Cloudflare IP allowlisting
- Use Firewall Rules for flexible, precise control.
- Use IP Access Rules for quick allow decisions.
- Use CIDR notation for IP ranges when needed.
- Prefer the smallest possible scope to reduce risk.
- Review temporary rules and test after changes.