# How to whitelist an IP address

Add an IP address to the allow-list to **trust it permanently**. Trusted clients bypass rate-limiting
and blocking, and are never caught by the automatic protection that blocks repeated failed logins. Use
it for addresses you control - your office, a monitoring service, or a partner integration.

> [!WARNING]
> An allow-listed client skips the firewall's protections. Only add addresses you genuinely trust, and
> keep the list as narrow as possible.

## Add a trusted IP on the Security tab (recommended)

For lasting trust, add the address to the host configuration so it stays across deployments:

1. Open the host and go to the **Security** tab.
2. Under **Whitelist IP Addresses**, add the IP address, or the tightest range that covers it.
3. Save and [publish](../../platform/hosts/publishing.md).

This writes the `firewall_whitelist` key for you - see [Configure the firewall](configure.md).

## Whitelist immediately with the CLI

To trust an address right away - for example to restore access for someone who is locked out - connect
over [SSH](../../platform/hosts/ssh.md):

```bash
tscli firewall whitelist 198.51.100.7
```

For a change that must last, also add it on the Security tab as above.

## Remove from the allow-list

```bash
tscli firewall unlist 198.51.100.7
```

If you added the address on the Security tab, remove it there and publish.

## Related

- [Configure the firewall](configure.md)
- [Block an IP address](block-an-ip.md)
- [Host Security tab](../../platform/hosts/security.md)
- [TurboStack CLI](../../api/cli.md)
- [Security hardening](../../concepts/security-hardening.md)