Where should an allowed IP appear relative to a WP Engine blocking rule?

Definition: Put the allowed IP rule above the broader WP Engine blocking rule. Web Rules are read from top to bottom, so the first matching access rule takes priority and the specific exception is evaluated before the block.

Key facts

• WP Engine says Web Rules are read from top to bottom and that rules read first take priority in the list of rules. WP Engine's Web Rules Engine documentation states this directly.
• To block an IP range while allowing one IP inside it, WP Engine documents two rules: the allow rule first, followed by the range block.
• A specific exception higher in the list keeps its priority over later rules, including country and user-agent denials.
• Access rules support an IP or IP range and can have conditions attached. WP Engine describes access rules as being read in cascading order.
• WP Engine's current alternative to custom .htaccess access rules is the User Portal's Access Rules page, which is enabled on all websites on the platform. Its .htaccess deprecation documentation describes that replacement.

Why does the allowed IP go first?

WP Engine's Web Rules Engine evaluates the list from the top down. The first rule that takes priority can determine the result before a later broader rule applies. An allow rule for one address therefore belongs above a deny rule for the range, country, user agent, or URI that would otherwise include that address.

The documented country example uses the same pattern. A specific IP is placed at the top, while rules below deny countries and a user agent. WP Engine says the top rule allows that IP even when the request comes from a blocked country or uses the blocked user agent.

What should the rule pair look like?

Use an allow rule for the narrow exception and a deny rule for the broader scope. The following structure matches WP Engine's documented example for restricting wp-login to one IP. Replace the placeholder with the address that should retain access.

First rule, above the second rule
Action: Allow
IP: [IP address to allow]
Conditions:
  Type: URI
  Operator: Regex matches (~)
  Value: wp-login

Second rule, below the first rule
Action: Deny
IP: All
Conditions:
  Type: URI
  Operator: Regex matches (~)
  Value: wp-login

For a country exception, use the same order with the specific IP allow rule above the country deny rule. The rule names or comments should identify the exception because WP Engine notes that the order matters as the list changes.

How do you change and verify the order?

Open Web Rules for the environment and select Access Rules. When adding a rule relative to an existing rule, WP Engine documents that inserting it above creates a rule that is read first, while inserting it below creates a rule that is read second. The interface also supports moving rules up or down and sending them to the top or bottom.

Keep the rule pair in the same access-rule list. WP Engine separates Access Rules, Header Rules, and Rewrite Rules into tabs, and the priority described here concerns access decisions. Requests blocked by an access rule return 403 Forbidden.

An allow rule cannot reverse every kind of block. WP Engine states that an IP blocked for security reasons at the server level cannot be allowed with Web Rules. Its Web Rules allow behavior applies to IPs denied by another access rule, so a platform-level block requires WP Engine Support.

Related terms

• Can WP Engine Web Rules allow an IP blocked by platform security?
• How can WP Engine apply a response header rule to selected requests?
• Which WP Engine rewrite rule runs when several rules match a URL?
• How does Cloudflare evaluate the order of custom WAF rules?

FAQ

Should the allowed IP be below the country block?

No. Put the specific allow rule above the broader country deny rule so WP Engine reads the exception first.

Does the same order apply to a blocked IP range?

Yes. WP Engine's example places the single-IP allow rule first and the IP-range block second.

Can Web Rules override a WP Engine server-level block?

No. WP Engine documents that Web Rules cannot allow an IP blocked for security reasons at the server level. The allow rule covers an IP denied by another access rule.

Sources

1. WP Engine, "Configure Web Rules Engine", 2 March 2026
2. WP Engine, ".htaccess Deprecation and Alternatives", 28 July 2025

---

Check how a page reads to answer engines. Open the GEO score analyzer