Control which IPs and countries can reach your organization — four related lists on one screen.
Before you start
The Manage Access Rules right.
Steps
Go to Settings → System Security → Access Blocks. There are four sections:
IP Whitelist / IP Blacklist
- Click Add (whitelist) or Block (blacklist).
- Enter an IP Address or CIDR Range (e.g.
192.168.1.100or10.0.0.0/24— IPv4 only) and an optional description. - Save. Whitelisted addresses always take priority over blacklisted ones if the same IP somehow ends up on both.
Temporary Blocks
- Click Add Temp Block.
- Enter the IP/CIDR, an optional description, a Duration, and a unit (Minutes/Hours/Days/Months/Years).
- Save. The row shows a live countdown to expiry.
- To make it permanent, click the Promote to blacklist (gavel) icon on the row instead of waiting for it to expire.
- There's no way to extend or shorten a temp block's duration after creation — only delete it or promote it.
Geo-Blocking
- Choose Block or Allow mode, then search for a country and submit.
- Read the banner carefully before adding your first allowed country: once any country is on the allow list, every other country is denied by default, regardless of the block list. With an empty allow list, every country is allowed except ones you've explicitly blocked.
- Use the swap-arrow icon on a country row to move it between Allowed and Blocked.
What you'll see
Changes apply immediately to incoming requests. See Access Blocks Explained for how these four mechanisms relate to each other and to automated detection rules.
Related articles
Other guides that answer questions close to this one.
Access Blocks Explained
Four related but distinct ways to control who can reach your organization, all on one Settings screen: IP Whitelist — always allowed, and always wins if the same address is also blacklisted. IP Blacklist — permanently…
How to Configure Detection Rules
Note: there's no visible "New Rule" button in the current UI — only editing, enabling/disabling, and deleting an existing rule. The create path exists in the underlying code but nothing in the interface reaches it.…
How to Review System Access Logs
Note: the Settings landing page card for this used to be called "Suspicious Behavior" — that name and its old URL slug (?tab=suspicious-behavior) are stale leftovers from a rename; the real, current tab is "System…