When you shop for a time clock that can lock clock-in to your office network, you’ll run into two very different versions of the same feature — and the difference decides whether the tool fits a real workplace. A global IP whitelist applies one rule to everyone. A per-employee IP whitelist applies the rule person by person. For attendance, that distinction is the whole ballgame.
Here’s why it matters, with the scenarios where each one helps or hurts.
What a global-only whitelist actually does
A global IP whitelist is all-or-nothing: you list the addresses allowed to punch, and that rule applies to every employee equally. If an address is on the list, anyone can punch from it. If it isn’t, nobody can.
That sounds fine until you look at a normal small business, which is almost never all-or-nothing. Most teams are mixed:
- Cashiers and floor staff who should only clock in at the building.
- A bookkeeper or admin who works from home.
- A manager who covers two sites.
- A traveling salesperson who’s rarely at any office at all.
With a global-only whitelist, you’re forced into a bad trade. Turn it on, and your remote bookkeeper can’t clock in from home — she’s locked out by a rule meant for the cashiers. Leave it off, and your cashiers can punch from their couch — the very thing you bought the feature to stop. There’s no setting that says “strict for these people, open for those.” One rule, everyone, take it or leave it.
What per-employee changes
A per-employee IP whitelist removes that trade-off. The office-network requirement becomes a flag on each person, so you decide individually who has to be on-site to punch:
- Flag the cashiers and floor staff as office-only.
- Leave the remote bookkeeper unflagged — she clocks in from anywhere.
- Give the two-site manager an allowlist that covers both locations.
Now the same system serves your on-site staff and your remote staff at once, without weakening the rule for the people it’s meant to cover. That’s the difference between a control you can actually deploy and one that sits switched off because it’s too blunt to use.
This is exactly the model behind Punchwell’s office-IP clock-in lock: the requirement is set per employee, and it’s a hard control — an off-network punch is refused server-side, not merely logged.
The extra layer: per-office, not just per-person
Per-employee is the headline, but real depth comes from combining scopes. Punchwell keeps three allowlists that union together — company-wide, per office, and per employee — so adding an address only ever widens access, never accidentally locks someone out:
- Company-wide addresses everyone can use.
- Per office — each location carries its own IPs, so a punch from the warehouse and a punch from the downtown branch both pass, each against their own site.
- Per employee — extra addresses for one person’s specific situation.
So a two-site manager isn’t a special headache; their punches simply match whichever office they’re standing in. You get to describe your actual workplace instead of flattening it into one global rule. And because you can allow exact IPs, CIDR blocks like 203.0.113.0/24, or address ranges, the allowlist stays short even when the network is large.
Where this bites in practice: the WP ERP example
This isn’t a hypothetical distinction. Among WordPress HR plugins, the closest competitor, WP ERP, offers an attendance IP whitelist — but it’s global-only: everyone or no one. (Approximate, as of June 2026 — confirm current capabilities.) For a single-location shop where every employee is on-site, that can be enough. For the mixed team above, it forces the exact bad trade we just described.
WP ERP also tends to stack up on price: its Pro tier plus a per-user yearly fee plus à-la-carte modules — Attendance and Payroll each at their own monthly cost — which crosses $99/yr at around three users (approximate, as of June 2026 — confirm current rates). Punchwell bundles the per-employee and per-office IP depth into one flat annual price with unlimited employees. If you’re weighing the two directly, the WP ERP comparison lays out the per-employee-vs-global difference and the module-stacking math side by side.
How to choose
- If your whole team is on-site, all the time, a global whitelist can technically work — but you’ll wish for per-employee the first time you hire one remote person.
- If your team is mixed at all — even one remote admin or one two-site manager — per-employee (plus per-office) is the difference between a control you actually run and one you leave off.
Buy for the team you’ll have in a year, not just today. Adding a remote role is common; being forced to disable your whole attendance control because of one is avoidable.
Frequently asked questions
What’s the difference between a global and a per-employee IP whitelist?
A global whitelist applies one set of allowed addresses to every employee — all or nothing. A per-employee whitelist sets the office-network requirement individually, so you can lock on-site staff to the building while letting remote staff clock in from anywhere.
Why does per-employee IP whitelisting matter for attendance?
Because most teams are mixed. A global-only rule forces you to either lock out your remote workers or leave your on-site staff free to punch from home. Per-employee control lets one system be strict for the people who must be on-site and open for those who legitimately aren’t.
Does WP ERP support per-employee IP whitelisting?
Its attendance IP whitelist is global-only — everyone or no one (approximate, as of June 2026 — confirm current capabilities). Punchwell’s lock is per-employee and per-office, so on-site and remote staff can be handled by the same system without disabling it for everyone.
The bottom line
A global IP whitelist asks your whole team to be identical. Real teams aren’t. Per-employee control — layered with per-office allowlists — is what lets an office-network lock survive contact with a mixed workforce. If you want the full mechanics, start with the office-IP clock-in lock feature page.
Punchwell is an independent, third-party maintained fork of the GPL-licensed “WP Human Resource Management” plugin. Sturdyhaus is not affiliated with, endorsed by, or sponsored by wpspear, weDevs, the original author, or any other prior maintainer. WP ERP is referenced descriptively only; all trademarks belong to their respective owners. Competitor pricing and capabilities are approximate, as of June 2026 — confirm current rates before relying on them.