If you’ve decided you want staff to clock in only when they’re actually at work, you’re asking the right question: how do you restrict a time clock to your office Wi-Fi so a punch from home or the parking lot simply won’t register? On WordPress, you can do exactly that, and it takes about ten minutes once you know the moving parts. This is the plain-English, step-by-step version.
One clarification up front, because it’s the thing most guides get fuzzy about: “office Wi-Fi” doesn’t mean the network’s name or its 192.168.x.x internal addresses. It means your office’s public IP address — the single address your whole office shares out to the internet. That’s what a time clock can actually check, and it’s what an office-network lock is built around.
How the lock works, in one paragraph
Every internet connection has a public IP. Your office Wi-Fi and wired network share one. An office-IP clock-in lock keeps an allowlist of addresses and only accepts a punch that comes from one of them. A device on your office network carries your office’s public IP, so it’s allowed. A phone at home carries a different one, so its punch is refused — server-side, before it’s ever recorded. That’s the whole idea, and it’s how Punchwell’s office-IP clock-in lock enforces attendance rather than just logging a location.
Now the setup.
Step 1 — Find your office’s public IP
From a device on your office network, open the IP-entry screen in the plugin and use the built-in “Use this IP” helper — it fills in the public address you’re currently connecting from, so there’s no guesswork. (If you’d rather check independently, any “what’s my IP” lookup from an office device shows the same number.) Do this on-site, not from home, or you’ll allowlist the wrong network.
Step 2 — Decide the scope
Punchwell lets you set allowlists at three levels, and they combine — adding an address only ever widens who can punch, never narrows it:
- Company-wide — one address (or range) that applies everywhere. Good for a single-location business.
- Per office — each location carries its own IPs. Good for multi-site shops, so the downtown branch and the warehouse each have their own network.
- Per employee — extra allowed addresses on an individual’s profile, for the odd exception.
For most single-office setups, a company-wide entry is all you need. Multi-location businesses should add each site under its own office.
Step 3 — Add the address (single IP, range, or CIDR)
You have three ways to enter what’s allowed:
- A single IP — the simplest case, one office on one connection.
- An address range — if your ISP hands your office several addresses.
- A CIDR block — shorthand like
203.0.113.0/24that covers a whole block of addresses at once, so you don’t list each one by hand. IPv4 and IPv6 are both supported.
A note on dynamic IPs: many business internet plans use a dynamic public IP that can change occasionally. If yours does, you have two clean options — ask your ISP for a static IP (often a small add-on), or allowlist the CIDR range your ISP assigns from, so an address change within that block still passes. It’s worth confirming which you have before you rely on a single fixed address.
Step 4 — Flag the employees who must be on-site
The lock is applied per employee, so you decide who it covers. Flag your on-site roles — cashiers, floor staff, clinic front desk — as “requires office IP.” Leave genuinely remote people (a bookkeeper, a traveling manager) unflagged so they can keep clocking in from anywhere. You can also set new employees to be locked by default, or lock by role, so you don’t have to remember to tick the box each time you hire.
Step 5 — Choose an enforcement mode (start with warn)
Punchwell gives you three modes:
- Block — off-network punches are hard-refused.
- Warn — the punch goes through but is recorded as off-network.
- Flag — a silent mark; like warn, it doesn’t block.
Start in warn for a week or two. Real workplaces have edge cases — a manager who opens before the Wi-Fi is fully up, someone covering a second site — and warn mode surfaces them without locking anyone out. Handle each exception with the per-office or per-employee allowlist, then switch the on-site roles to block. You can also have HR emailed whenever an off-site punch is refused, so a block is a heads-up rather than a mystery.
Step 6 — Test it both ways
Take a test punch from an office device — it should go through. Then, from a phone on cellular data (off your Wi-Fi), try again — in block mode it should be refused. Two punches and you’ll know the rule is live. Worth knowing: clock-out is never blocked by the network, so nobody gets stuck on the clock because they stepped outside.
A couple of honest caveats
- A VPN changes the picture. If a staff member is on a VPN, their traffic may exit from a different public IP than your office — which is usually what you want (it won’t match), but it’s worth being aware of.
- Guest networks sometimes route through a different address than your main line. If you allow punching from a tablet on guest Wi-Fi, add that address too.
- The IP lock is the hard control; GPS is a softer companion. If some staff are legitimately mobile, pair the lock with a GPS geofence rather than trying to force everyone onto one network.
Once the lock is set, the rest of the timesheet — shift policies, rounding, grace periods, auto clock-out — is handled by the everyday attendance rules. If you want to see how raw punches become a clean, payroll-ready timesheet, that’s covered on the time clock and attendance feature page.
Frequently asked questions
Does restricting to “office Wi-Fi” mean the network name or the IP address?
The IP address. A time clock can’t reliably see a Wi-Fi network’s name, and internal addresses like 192.168.x.x aren’t visible on the internet. What it checks is your office’s public IP — the single address your whole office shares — so that’s what you allowlist.
What if my office IP address changes?
Many business plans use a dynamic public IP. Either ask your ISP for a static address, or allowlist the CIDR range your ISP assigns from so a change within that block still passes. Confirm which you have before relying on one fixed address.
Can some staff be locked to the office while others clock in remotely?
Yes. The lock is per employee. Flag only your on-site roles as office-only and leave remote staff unflagged, or grant them extra allowed addresses. On-site cashiers stay locked to the building while a remote bookkeeper clocks in from home.
The bottom line
Restricting a WordPress time clock to your office Wi-Fi comes down to one allowlisted public IP, the right scope, the right people flagged, and a warn-first rollout. If you want the full detail on ranges, per-office allowlists, and enforcement modes, start with the office-IP clock-in lock feature page.
Punchwell is an independent, third-party maintained fork of the GPL-licensed “WP Human Resource Management” plugin. Sturdyhaus is not affiliated with, endorsed by, or sponsored by wpspear, weDevs, the original author, or any other prior maintainer. Product names referenced descriptively only; all trademarks belong to their respective owners.