IP whitelisting
Authorising a proxy by pre-approving the IP addresses allowed to use it, instead of sending a username and password.
IP whitelisting authenticates by origin rather than by secret. You register which source addresses are yours, and the proxy accepts connections from those and refuses everything else. Nothing is transmitted with the request because your address IS the credential.
The appeal is the absence of a secret. Nothing to embed in a scraper's configuration, nothing to commit to a repository by accident, nothing to appear in a log or a support ticket, nothing to rotate after somebody screenshots their terminal. For a server with a fixed address it is the cleanest arrangement available, and it removes an entire class of mistake.
The weakness is the exact mirror of the strength: it binds you to an address that must not change. A home connection renewing a dynamic IP, a laptop moving between networks, a container scheduled onto a different host, a cloud instance replaced by autoscaling. Each of those silently stops matching, and access ends until the list is updated.
The failure is also confusingly quiet, which is worth anticipating. A connection refused for a whitelist mismatch usually looks like an authentication error or a plain refusal rather than anything that says your address changed, so the natural assumption is that the proxy is down. If a working setup stops working after nothing changed on your side, check your own public address first.
There is a real security caveat too, and it is the reason to prefer both mechanisms where a provider allows it. Whitelisting trusts an address, and addresses are shared: on a network using carrier-grade NAT or behind a shared office connection, whitelisting your public IP may authorise everyone else on it. On a fixed server address that is a non-issue; on a home or mobile connection it is worth thinking about.
Frequently asked questions
My whitelisted proxy suddenly stopped working, why?
Check your own public address before anything else. Dynamic home connections renew, laptops move networks, containers get rescheduled and cloud instances are replaced, and any of those breaks the match silently. The failure usually presents as an authentication error or a refusal rather than as anything mentioning your address, so it reads like the proxy being down.
Can I whitelist a dynamic IP address?
Only by keeping the list updated as it changes, which is a maintenance burden rather than a solution. If your address moves, credentials are the appropriate mechanism. Some people automate whitelist updates through a provider API, which works but adds a moving part that fails at the worst time.
Is IP whitelisting more secure than a password?
It is more secure against leaks, since there is no secret to leak, and less secure against address sharing. Behind carrier-grade NAT or a shared office connection, whitelisting your public address may authorise everyone else using it. On a dedicated server address it is excellent; on a shared connection it deserves more thought.
Can I use whitelisting and credentials together?
Many providers allow it, and it is the strongest arrangement when your address is stable. A leaked credential is then useless from an unregistered address, and an address alone is not sufficient either. It gives up the convenience of each and keeps the protection of both.
Back to the full glossary.