If you run an hourly or shift team, the cost of time theft for a small business rarely shows up as one big, obvious loss. It shows up as a few extra minutes here, a forgotten clock-out there, and the occasional “can you punch me in, I’m running late.” None of it feels like much in the moment. On a payroll run, it quietly adds up.
This post is about that quiet math: how small amounts of padded time accumulate, where it tends to hide, and the difference between a time clock that records the problem after the fact and one that prevents it at the moment of the punch. We’ll keep the numbers illustrative rather than citing scary statistics, because your real exposure depends on your team, your wages, and your shifts — not on someone else’s survey.
What “time theft” actually means
Time theft isn’t usually dramatic. For most small businesses it’s some mix of:
- Buddy punching — one employee clocks a coworker in (or out) who isn’t actually there yet, or already left.
- Early-in / late-out padding — clocking in from the parking lot ten minutes before the shift, or clocking out from the break room after the work is done.
- Off-site punching — clocking in from home, the commute, or anywhere that isn’t the job, especially with a phone-based app.
- Forgotten clock-outs — honest mistakes that, left uncorrected, bill hours nobody worked.
Most of this isn’t malicious. It’s friction and habit. But it’s still hours you pay for and didn’t get.
The illustrative math: small minutes, real money
Let’s not invent a statistic. Instead, let’s reason from numbers you can plug your own figures into.
Say you have 15 hourly staff at an average $17/hour. Suppose the typical person picks up an extra 6 minutes a shift — a single rounded-up arrival, a slightly early punch-out — across roughly 250 shifts a year.
- 6 minutes is 0.1 hours.
- 0.1 hours × $17 = $1.70 per shift, per person.
- $1.70 × 250 shifts = $425 per person per year.
- × 15 people = roughly $6,375 a year.
Change the inputs and the answer moves, but the shape holds: a few minutes a shift, multiplied across a team and a year, is real money. Even if your number is half of that, it’s still likely more than the annual cost of the software meant to control it. (We’ll come back to that.)
The point isn’t the exact figure. It’s that the unit of time theft is minutes, and minutes are easy to dismiss one at a time and expensive to ignore in aggregate.
Where it hides
Time theft is hard to see because it lives in places a normal timesheet doesn’t surface:
- In the rounding. If every punch rounds in the employee’s favor, you’ve built leakage into the system.
- In the location. A standard timestamp says when someone punched. It usually doesn’t enforce where they were standing.
- In the corrections. Forgotten and “fixed” punches are where a lot of padding quietly enters, because there’s no record of what actually happened.
- In the trust gap. Most owners don’t want to police their staff, so the problem goes unaddressed until a payroll number finally looks wrong.
Two of those — location and corrections — are where the biggest dollar leaks usually sit, and they’re exactly where the choice of tool matters most.
Record vs. prevent: the distinction that decides your bill
Here’s the core idea, and it’s the one most time-clock comparisons skip.
Most affordable time clocks record location. They take a GPS reading at punch time and store it. If someone clocks in from home, you can find out later by reviewing the log. That’s useful for an audit. It does nothing in the moment, and GPS can be spoofed from a phone sitting on a couch.
A smaller set of tools prevent an off-site punch. They refuse it at the moment it happens, server-side, so the bad punch never enters your timesheet in the first place. There’s nothing to review later because it didn’t get recorded as worked time.
For the location-based piece of time theft, prevention is the control that actually changes your payroll number. Recording just gives you evidence after you’ve already paid.
The control that prevents off-site punching
Punchwell’s flagship feature is a hard-enforced, per-employee office-IP clock-in lock. Flag an employee as office-only, and they can punch in or out only from an address on your allowlist. If the device isn’t on your office network, the punch is refused server-side — it doesn’t just get logged with a flag, it doesn’t go through. That closes the off-site and buddy-punching gap at the source, because someone at home simply can’t register a punch.
The depth is what makes it practical for a real shop:
- Allowlist by exact IP, CIDR block (a whole range like
203.0.113.0/24), or address range — IPv4 and IPv6. - Three scopes, unioned and widen-only: company-wide, per-office (each location can carry its own IPs), and per-employee. Adding an address only ever widens access, so you won’t accidentally lock anyone out.
- Block, warn, or flag modes — choose how strict to be. (Worth being precise: only block actually refuses the punch; warn and flag let it through and note it.)
- Optional clock-in time window so a punch is only accepted around shift start. It’s direction-aware and won’t block someone from clocking out.
GPS can be faked from a phone at home; an office-IP lock can’t. So Punchwell pairs the hard IP control with an optional GPS geofence (per-office radius), a kiosk / wall-tablet clock (employees clock in with a short code and PIN on a shared device), and a mobile/PWA punch screen — softer or stricter, your call. Treat the geofence as a deterrent, not proof of presence; the IP lock is the hard control.
For the corrections leak, the attendance-report add-on gives you day-by-day reports plus manual punch edits for genuinely missed or wrong punches — so honest mistakes get fixed deliberately and visibly, instead of becoming a back channel for padding. Shift policies handle the rounding side: configurable rounding, grace periods, auto clock-out for forgotten punches, and overnight shifts.
See exactly how the hard control works in the IP clock-in lock feature page, and how the softer ones complement it in GPS geofence, kiosk and mobile punch.
How the controls compare across the market
If you’re shopping, it helps to know which tools prevent versus record. (Figures below are approximate, as of June 2026 — confirm current rates with each vendor.)
- Most SMB time clocks — Homebase, Deputy, When I Work, Connecteam, Jibble — do GPS geofencing only, no IP lock. GPS needs an app and can be spoofed. For a 25-staff team, Deputy runs roughly $1,950/yr, When I Work roughly $2,100/yr, and they bill per head.
- Buddy Punch does ship true IP restriction and GPS — a capable product — but it’s per-user SaaS (around $19/mo base plus roughly $4.49–10.99 per user per month), with your data in their cloud, landing near $1,520/yr for 25 staff.
- Zoho People offers true per-user IP restriction at about $2/user/mo, as part of a broader HRIS upsell.
- WP ERP, the closest WordPress competitor, has an attendance IP whitelist that is global-only — everyone or no one, with no per-employee lock — and stacks à-la-carte modules (its core plus a per-user yearly fee plus separate monthly module fees), which crosses $99/yr at only a few users.
Punchwell sits deliberately at the prevention end — per-employee, per-office IP enforcement that refuses the punch — and it’s per site, not per seat.
Where the cost math lands
Recall the illustrative figure above — somewhere in the low thousands a year for a modest team, scaling with your headcount and wages. Now put the tool cost next to it.
Punchwell is free on WordPress.org for the community base (which includes a basic single-office IP lock), then $99/year per site — flat, with unlimited employees, no per-seat fee. Hire your hundredth person and the price doesn’t move. Compare that to the roughly $1,500–2,100/yr a 25-person shop pays per-head SaaS clocks (approximate, as of June 2026), and the spend-vs-leakage gap usually closes in the tool’s favor fast.
It’s also self-hosted — it lives inside the WordPress site you already run, your timesheets stay in your own database, and there’s no cloud holding your data and no data call-home (verified — the free version makes zero outbound calls; Pro’s only outbound call is license validation, never your data). For clinics, dental practices, and agencies that can’t put staff data in someone else’s cloud, that’s often the deciding factor alongside the price.
See the full breakdown on the pricing page, or read more about how data stays on your server in the security overview.
The honest bottom line
You probably can’t eliminate every minute of padded time, and you shouldn’t try to run your team like a courtroom. But the location-based piece — off-site and buddy punching — is the part that’s genuinely preventable, and it’s usually the largest leak. A tool that refuses an off-site punch changes your payroll number; a tool that merely logs one gives you something to read after you’ve already paid.
If buddy punching or off-site clock-ins are the problem you’re trying to close, the free community version is a low-stakes place to start. Download the free version and turn on the office-IP lock for the staff who should only be punching from the building.
Punchwell is an independent, third-party maintained GPL fork of the “WP Human Resource Management” plugin. Sturdyhaus is not affiliated with, endorsed by, or sponsored by wpspear, weDevs, or the original author. Product names (including Buddy Punch, Deputy, When I Work, Homebase, Connecteam, Jibble, Zoho People, and WP ERP) are referenced descriptively only and belong to their respective owners. Competitor figures are approximate, as of June 2026 — confirm current rates with each vendor.