IP Access Policies

Allow / deny by IP, CIDR, ASN, or country. The cheapest decision layer — runs first, short-circuits everything else when matched.

Why IP access first

IP-based decisions are O(1) — a hashtable lookup. When a request comes from an IP you've already decided about, no other layer needs to run. Putting this layer first cuts compute cost for both attacks (block early) and trusted partners (allow + skip downstream layers).

What you can match on

  • Individual IPs — IPv4 + IPv6.
  • CIDR ranges — both v4 (10.0.0.0/8) and v6 (2001:db8::/32).
  • ASN — block whole hosting providers (e.g. AS14061 DigitalOcean, AS16509 Amazon, AS396982 Google Cloud — useful when your customers are end-users, not server farms).
  • Country (ISO 3166-2) — geographic blocking. Use sparingly; ineffective against attackers using residential VPNs but useful for legal/compliance reasons.
  • Cloudflare threat-intel categories — pre-curated lists: known anonymizers, recent threat-actor IPs, scanners.

Decision precedence

When multiple rules match the same request:

  1. Allow rules win over Deny rules. An IP in both an allow CIDR and a deny ASN list is allowed.
  2. Among allows: most specific wins (individual IP > CIDR > ASN > country).
  3. Among denies: any matching deny blocks.

Allow rules (use cases)

  • Office IPs — your team's static IPs always pass.
  • Partner APIs — known third-party integrations.
  • Monitoring — UptimeRobot, Pingdom, etc. (they publish their IP ranges).
  • Payment providers — Stripe/PayPal webhook IPs.

Deny rules (use cases)

  • Repeat-offender IPs surfaced by your other Shield layers (auto-promotion available — see below).
  • Known-bad ASNs — cheap server farms used for credential stuffing.
  • Geographic blocks for regions where you have no legitimate users + compliance restrictions (e.g. sanctioned countries).

Auto-deny from repeat blocks

Enable Auto-denyat Shield → IP Access → Settings. When an IP gets blocked > N times in 1 hour by ANY Shield layer, it's automatically added to the deny list for 24 hours. Tunable N (default 50) and TTL (default 24h).

Lifts itself after the TTL — no permanent IP bans unless you add them manually. Permanent bans tend to cause customer-support drama later when an IP gets reassigned to a real user.

Import / export

Rules are bulk-manageable via CSV import:

type,value,action,note
ip,203.0.113.42,deny,credstuffing 2026-05
cidr,198.51.100.0/24,allow,Office NYC
asn,AS14061,deny,DigitalOcean droplets
country,CN,deny,no legitimate users + compliance

What's next

  • Rate Limiting — IP access pairs with rate limiting for layered defense.
  • Bot Detection — IPs frequently signaled by bot detection can be auto-denied.