Blacklist

What is a Blacklist?

In WordPress and the IT world-at-large, a blacklist is a list of untrusted sources or objects. This list is used to deny those same sources and objects access to resources.

The term ‘untrusted sources and objects’ is very generic, with good reason. Blacklists can be set up to block all sorts of things including sources such as IP addresses and email addresses and objects such as keywords, users, names, and others. Moreover, blacklists can be configured to block access to specific resources at different levels, making them a flexible if cumbersome tool.

Why is a Blacklist important?

When it comes to WordPress, blacklists are generally set up to stop spam and/or attacks. While their effectiveness is often disputed, the fact that they are still around indicates that in certain scenarios they can be quite useful.

No WordPress security tool is an end-to-end solution, and the same applies to blacklists. Rather, it must play its part in a security ecosystem in which it can play on its strengths. This starts through an understanding of how it works…

How do blacklists work on WordPress

Blacklists are generally maintained as a list of blocked objects and sources. This list is consulted whenever access to a corresponding resource is requested.

For example, a spam blacklist is consulted before a comment is posted, making sure that any objects listed in the blacklist are not present in the comment. An IP blacklist, on the other hand, is consulted before access to a resource is given by looking at the IP address of incoming requests.

How to create WordPress blacklists

Blacklists can be created and maintained at different levels. In WordPress, blacklists work at the WordPress level and at the web server level, giving you a degree of flexibility over how blacklists are implemented.

WordPress blacklist

WordPress hosts its own blacklist called Disallowed Comment Keys. As the name suggests, this blacklist is specifically designed to stop specific visitors from posting comments on your WordPress website.

The WordPress blacklist can easily be accessed from the WP Admin portal by clicking on Settings from the side menu and then clicking on Discussion. Locate the Disallowed Comment Keys section and enter the blacklisted objects, one per line. The WordPress blacklist accepts the following objects:

  • Keywords
  • Author names
  • URL
  • Email address
  • IP address
  • Browser user agent string

Plugin blacklist

One other way to blacklist objects on WordPress is by using plugins. Such plugins come in different shapes and sizes, allowing you to blacklist anything from IPs to spam terms. Since different plugins can take a different approach to how the blacklist is implemented, make sure you read any accompanying documentation to ensure you choose the best plugin for your WordPress website’s requirements.

Web Server blacklist

Web server blacklisting requires more technical knowledge than the previous two methods mentioned. You will need to have access to the server, which is usually done through cPanel (or equivalent) or SSH/ Powershell.

You can also block IP addresses using the .htaccess file, provided you’re using an Apache web server. The file can be placed in any directory or subdirectory, giving you complete control over which pages you restrict access to. Refer to the definitive htaccess guide for WordPress administrators for more information.

How the web server can be accessed will depend on your hosting provider and your technical abilities. If you’re unfamiliar with the process, an experienced web administrator might be able to help you set it up.

Stay in the loop

Subscribe to the Melapress newsletter and receive curated WordPress management and security tips and content.

Newsletter icon

It’s free and you can unsubscribe whenever you want. Check our blog for a taste.

Envelope icon
Uploading WP 2FA as a zip file in WordPress
WP 2FA in the WordPress plugin repository
Close

Installing WP 2FA Free

Congratulations on taking the first step towards enhancing your WordPress site's security with WP 2FA Free! You're now on your way to protecting your valuable data and ensuring peace of mind. No coding or technical knowledge is required.

 

Below are two ways to install WP 2FA on your website:

Go to your plugin dashboard on your site, then go to "Add New", and then search for WP 2FA.

Download the WP 2FA plugin zip, then select upload in your plugin dashboard under "Add New".

OPTION 1

OPTION 2

Uploading CAPTCHA 4WP as a zip file in WordPress
CAPTCHA 4WP in the WordPress plugin repository
Close

Installing CAPTCHA 4WP Free

Well done you. You're one step closer to safeguarding your WordPress website from spam and automated attacks with CAPTCHA 4WP. You'll be able to effortlessly integrate CAPTCHA into your forms and enjoy a website with enhanced security.

 

Below are two ways to install CAPTCHA 4WP on your website:

Go to your plugin dashboard on your site, then go to "Add New", and then search for CAPTCHA 4WP.

Download the CAPTCHA 4WP plugin zip, then select upload in your plugin dashboard under "Add New".

OPTION 1

OPTION 2

Uploading WP Activity Log as a zip file in WordPress
WP Activity Log in the WordPress plugin repository
Close

Installing WP Activity Log Free on your website

You deserve a pat on the back for choosing to record user actions and changes on your website. That is the first step towards better user accountability, easier troubleshooting of website security, and many other benefits of issues.

 

Below are the two ways to install WP Activity Log on your website:

Go to your plugin dashboard on your site, then go to "Add New" and then search for WP Activity Log.

Download the WP Activity Log plugin zip, then select upload in your plugin dashboard under "Add New".

OPTION 1

OPTION 2

Uploading Melapress Login Security as a zip file in WordPress
Melapress Login Security in the WordPress plugin repository
Close

Installing Melapress Login Security Free

Congratulations on taking control of your WordPress website's security by implementing robust login and password policies with Melapress Login Security. You can change your login page URL, limit failed login attempts, and reset passwords.

 

Below are two ways to install Melapress Login Security on your website:

Go to your plugin dashboard on your site, then go to "Add New" and then search for Melapress Login Security.

Download the Melapress Login Security plugin zip, then select upload in your plugin dashboard under "Add New".

OPTION 1

OPTION 2