GPS Geofence, Kiosk & Mobile/PWA Punch Setup

Punchwell gives you four ways to capture a clock-in, and you can layer them however your sites need:

The office-IP lock — the flagship hard control. It refuses an off-site punch server-side. (Covered in its own guide: the office-IP clock-in lock.)
The GPS geofence — checks the worker’s phone against the work site when they punch from the mobile screen. A deterrent, not proof of presence.
The kiosk clock — a shared wall-tablet where staff punch with a short code and PIN, no individual logins on the device.
The mobile/PWA punch screen — a phone-first clock-in page each employee can install to their home screen.

This page walks through setting up the GPS geofence, the kiosk, and the mobile/PWA punch, then explains how they combine with the IP lock and when to reach for each.

Honest framing, up front. GPS can be approximate indoors and can be spoofed from a couch, so treat the geofence as a deterrent, not proof that someone is physically present. The office-IP lock is the hard control — it can’t be faked from a phone at home. Pair them for the strongest result. Clock-out is never blocked by distance, so an open punch can always be closed.

The GPS, kiosk, and mobile features live in the hrm-frontend add-on; the geofence rules and IP lock they enforce live in the base plugin. Both ship in Punchwell Pro.

Before you start

Punchwell base active, and the hrm-frontend add-on active.
A working time clock: to punch at all, an employee must (in order) have an employee role → be assigned to a department → that department must have a shift policy. Miss any one and the punch is refused by design.
HTTPS for the mobile/PWA screen. Phones only share GPS over a secure (https://) connection, and the screen is only installable as a PWA on HTTPS. If your kiosk tablet or staff phones aren’t on https://, set that up first.
Decide your enforcement mode (Block / Warn / Flag) — see below. It’s shared by the IP lock and the geofence.

Part 1 — GPS geofence (per-office radius)

The geofence checks a punch’s GPS coordinates against the work site. You set a company-wide fence and, optionally, a per-office fence that overrides it for staff assigned to that office.

Step 1 — Set the enforcement mode and distance unit

Go to Punchwell → Settings → IP & Geofence.

Enforcement mode — choose how strict every location check (IP and GPS) behaves:
- Block — refuse the punch (hard lock).
- Warn — allow the punch, but log the off-site attempt.
- Flag — allow the punch and record the off-site attempt on the employee (fires the hrm_offsite_clockin_attempt hook). Warn and Flag behave identically as far as the worker is concerned — neither blocks.
Distance unit — Metres or Feet. This is only how radii are entered and shown. Distances are always stored internally in metres, so switching the unit never changes an existing fence.

Step 2 — Set the company-wide fence

Still on the IP & Geofence tab, under GPS geofence:

Tick Enable geofence (“Require clock-in within a radius of the office”).
Enter the work site’s Latitude and Longitude (e.g. 37.7749, -122.4194 — copy them from any maps tool).
Enter the Radius in your chosen unit. The default is 150 metres.
Save.

This single fence applies to everyone who punches from the mobile GPS screen — unless their assigned office has its own fence.

Step 3 (optional) — Per-office fences

If you run more than one site, give each office its own coordinates so staff are checked against the building they actually work in.

Go to Punchwell → Structure → Locations, add or edit a location, and under GPS geofence enter that office’s Latitude, Longitude, and Radius. Then assign each employee to their office on their profile under Punchwell Attendance Settings (the same “Job Location” assignment used by the IP allowlist).

An employee’s assigned office fence overrides the company-wide fence.
Leave a location’s radius blank to fall back to the company-wide fence (or to no fence).
The unit (metres/feet) follows the company setting on the Settings → IP & Geofence tab.

How the geofence behaves at punch time

The check only runs on a punch that carries coordinates — i.e. from the mobile/PWA GPS screen ([hrm_gps_punch]). The in-app and [hrm_clock] widgets don’t send GPS.
A missing or weak GPS fix never hard-locks a real worker out. The punch is still submitted; in Warn/Flag mode the distance is recorded, and the geofence is treated as a soft signal rather than a wall.
Clock-out is never blocked by distance.
Integrations can override a single check via the hrm_geofence_check filter.

Part 2 — Mobile / PWA punch screen

This is a phone-first clock-in page for staff who punch from the field or the floor. The device captures its GPS and sends it to the same base punch action the app uses — so the office-IP lock, geofence, and every clock-in prerequisite are enforced server-side. The screen never writes attendance itself and adds no privilege.

Step 1 — Create the punch page

Create a new WordPress page (e.g. “Clock In”).
Add the shortcode:
```
[hrm_gps_punch]
```
Publish it on an HTTPS URL and share the link with staff.

Logged-in employees see a single big Clock in / Clock out button with their current status. Not-logged-in visitors see a login form.

Step 2 — Let staff install it (PWA)

When the page is served over HTTPS, Punchwell injects a web-app manifest and icons into that page only, so phones can add it to the home screen and open it full-screen like an app — no App Store, no Play Store. (It’s a responsive web/PWA screen, not a native app.)

iPhone (Safari): Share → Add to Home Screen.
Android (Chrome): the browser offers Install / Add to Home screen.

The service worker caches only the static shell. Punches are never cached or queued — a punch must reach the server to be validated, so an offline punch fails loudly rather than recording an unverified time. That’s deliberate: queued offline punches would defeat the IP + geofence lock.

What the worker sees

The screen surfaces the rules that apply to them: a note that their location is checked against the work site (if the geofence is on), a reminder that they must clock in from the office network (if they’re IP-locked), an HTTPS warning if the page isn’t secure, and the honest “phone location can be approximate or spoofed” note. If a prerequisite is missing (no department, no shift policy, terminated, etc.), the server’s own message is shown inline instead of a button.

Part 3 — Kiosk clock (shared wall tablet)

The kiosk is a single shared device — a tablet by the door, a terminal at the front desk — where employees clock in and out with a short code and a 6-digit PIN. No one logs into WordPress on the device. Punches still run through the real base punch actions, so the office-IP lock re-applies for each resolved employee.

The kiosk has two independent gates: the device must be enrolled (a hashed token), and the tablet’s venue IP must match the allowlist. The venue gate fails closed — if no venue IPs are configured, the kiosk refuses everywhere.

Step 1 — Set the venue network and options

Go to Punchwell → Kiosk.

Allowed venue IPs / CIDR — one IP, CIDR block (203.0.113.0/24), or range per line. The kiosk only works from these networks. Leave blank and the kiosk is disabled everywhere. (If you leave it empty here, it defaults to the company allowlist from Settings → IP & Geofence.)
Trust X-Forwarded-For — leave off unless the kiosk sits behind a trusted reverse proxy/CDN. Off keeps the venue check spoof-proof.
Minimum PIN length — 4–12 (default 6).
Auto-reset seconds — how quickly the screen clears between people (2–30).
Save settings.

Step 2 — Create the kiosk page

Create a WordPress page (e.g. “Front Desk Clock”).
Add the shortcode (you can optionally name a specific enrolled device):
```
[hrm_kiosk]
```
or
```
[hrm_kiosk device="front-desk-tablet-ab12"]
```
Publish it. Serve it over HTTPS — the device cookie set during enrollment requires a secure context.

Step 3 — Enroll the tablet

On Punchwell → Kiosk, under Enroll a new device:

Enter a Label (e.g. “Front desk tablet”) and the Kiosk page URL from Step 2.
Click Add device. Punchwell shows a one-time provisioning URL — copy it now; it’s shown only once.
On the tablet, open that provisioning URL once. It sets a secure, httpOnly device cookie, strips the token from the address bar, and lands on the plain kiosk page. Bookmark that plain page.

You can Enable/Disable or Revoke any device from the same page; a revoked device stops working immediately.

Step 4 — Give each employee a code + PIN

On each employee’s WordPress user profile, under Punchwell Kiosk:

Set a unique, non-secret Kiosk code the employee types at the tablet. (Leave it blank to remove their kiosk access.)
Set a numeric PIN (minimum length per your setting). You can reset or clear it later — the PIN is stored hashed.

Staff then walk up to the tablet, type their code + PIN, and tap Punch. Each punch is resolved to that employee and run through the real base punch logic — so if that person is IP-locked, the office-network check still applies to their punch.

Combining with the IP lock

These controls stack. They don’t replace each other.

The office-IP lock is the hard control — flag an employee as office-only and they can punch only from an allowlisted address, no matter which screen they use. See the office-IP clock-in lock guide for per-employee, per-office, and company-wide allowlists, CIDR/ranges, and IPv4/IPv6.
The GPS geofence adds a location check for mobile punches specifically.
The kiosk venue IP is its own gate, plus device enrollment.
All of them honor the same Block / Warn / Flag enforcement mode from Settings → IP & Geofence.

The recommended combination for on-site staff: IP lock set to Block (the wall) + geofence on for mobile punches (the deterrent). GPS reassures you about where; the IP lock guarantees they’re on your network.

For field/remote staff who legitimately punch off-network: leave them un-IP-locked and rely on the geofence in Warn or Flag mode to record where they were, rather than blocking them.

When to use each

Scenario	Best fit
Fixed front desk / shop floor, shared device, no personal phones needed	Kiosk (+ IP lock on the venue network)
Staff carry phones; you want a quick personal clock-in	Mobile/PWA punch (+ geofence)
Office-bound staff you must keep honest about location	Office-IP lock = Block (optionally + geofence)
Field/site visits, deliveries, multiple job sites	Mobile/PWA punch + geofence in Warn/Flag (no IP lock)
Desk staff already in WordPress all day	The built-in app clock or the `[hrm_clock]` widget

FAQ

Does the GPS geofence block clock-out?
No. Distance never blocks a clock-out — an open punch can always be closed. The geofence only checks clock-in.

What happens if a worker’s phone can’t get a GPS fix?
The punch still goes through without coordinates. The server treats the geofence as a soft control (allowed, and recorded in Warn/Flag mode) rather than locking out a real worker over a missing fix. Geolocation also requires HTTPS — over plain HTTP the phone won’t share location and the punch is submitted without it.

Is the mobile punch a real app from the App Store / Play Store?
No. It’s a responsive web page you can install to your home screen (a PWA). There’s no native iOS or Android app.

Can someone fake their GPS location?
Yes — phone location can be approximate indoors and can be spoofed. That’s why we frame the geofence as a deterrent and recommend pairing it with the office-IP lock, which can’t be faked from a phone at home.

Why does my kiosk say “only available on the workplace network”?
The kiosk’s venue-IP gate fails closed. Either you haven’t entered any venue IPs under Punchwell → Kiosk (and the company allowlist is also empty), or the tablet isn’t actually on one of the allowlisted networks. Add the venue’s public IP/CIDR and reload.

Do kiosk punches still respect an employee’s office-IP lock?
Yes. Each kiosk punch is resolved to the employee and run through the same base punch logic, so an IP-locked employee’s punch still has to satisfy the office-network check.

Can I run different geofences for different offices?
Yes. Set per-office coordinates and radius under Punchwell → Structure → Locations, and assign each employee to their office. The office fence overrides the company-wide fence for that employee. Leave an office’s radius blank to fall back to the company-wide fence.

Does any of this send my data to a cloud?
No. Punchwell is self-hosted with no data call-home — coordinates, codes, and PINs stay in your own WordPress database. The only standard external content anywhere in the suite is optional YouTube tutorial embeds and Gravatar avatars.