This is the flagship feature: lock a given employee’s clock-in and clock-out to your office network, so on-site staff can’t punch from home or cover for each other. When an employee is locked, Punchwell checks their network address at the moment they punch and refuses the punch server-side if they’re off-network — it does not merely log a location. That’s the whole point: GPS can be faked from a couch; the address your office presents to the internet can’t be faked from a phone at home.
It’s a per-employee switch, off by default. Flip it on for the people who must be on-site (cashiers, floor staff) and leave it off for anyone who clocks in remotely. People are unaffected unless you turn them on.
This guide walks through it in order: find your public office IP → enter it → flag the right employees → (optionally) widen the allowlist with CIDR/ranges, per-office IPs, and per-employee IPs → choose an enforcement mode → add a clock-in time window. Then a troubleshooting section for the most common “punch refused” cases.
Where this sits in the suite. The basic single-office IP lock is in the free Community tier. The full depth described here — CIDR/range allowlists, per-office and per-employee allowlists, block/warn/flag modes, and the clock-in time window — is part of Punchwell Pro. The GPS geofence pairs with this lock and is covered separately; see GPS Geofence.
Step 1 — Find your public office IP
The address Punchwell checks is your office’s public internet IP — the address the outside world sees, assigned by your internet provider. It is not a 192.168.x.x or 10.x.x.x address (those are private LAN addresses and are useless here; every office on Earth has a device at 192.168.1.1).
To find it, from a computer connected to your office network, open a browser and search “what is my IP”, or visit any “what’s my IP” site. Copy the number it shows — for example 203.0.113.5.
Two shortcuts that save the trip entirely:
- Use the built-in helper. Every IP-entry box in Punchwell shows a “Your current IP: x.x.x.x” line with a Use this IP button right beneath it. If you’re filling in the box while sitting in the office, click the IP to copy it or the button to drop it straight into the field. This reports the exact same value the server uses to check punches, so it’s authoritative — no guessing.
- Note for dynamic IPs. Many small offices have an IP that changes occasionally (a “dynamic” IP from the ISP). If yours drifts, either ask your ISP for a static IP (often a few dollars a month), or allow your whole ISP-assigned range with a CIDR block (see Step 4). If you have more than one site or more than one internet line, you’ll likely have more than one public IP — collect them all.
Step 2 — Enter your office IP(s)
Go to Punchwell → Attendance → Configuration and enter your office’s public IP address. To allow more than one address, separate them with a vertical bar (|):
203.0.113.5|198.51.100.7
Save. Then open Punchwell → IP Restrictions — a notice at the top confirms the office IPs currently on file:
Office IP addresses: 203.0.113.5, 198.51.100.7
If that notice instead says “No office IP addresses are configured yet,” go back and add at least one address before you flag anyone — otherwise locked employees are blocked entirely (see Troubleshooting).
Step 3 — Flag the employees who must be on-site
Two equivalent ways to set the per-employee switch:
Bulk (fastest). On Punchwell → IP Restrictions you get a table of every Punchwell employee and manager with a Restrict to Office IP toggle. Flip it on for each person who must clock in from the building. It saves instantly — the label changes to “Office IP required” (or “Unrestricted” when off). This page requires Administrator access.
On the profile. Open any employee’s WordPress user profile and scroll to Punchwell Attendance Settings. Check Require office IP for clock-in/out. The same screen also has the per-employee allowlist and office assignment used in Step 4. Visible to administrators and to users who can edit other users.
That’s the minimum viable setup: office IP entered + the right people flagged. Everyone you didn’t flag continues to clock in from anywhere.
Lock by role, and lock new hires automatically
If you’d rather not toggle people one at a time, two options under Punchwell → Settings → IP & Geofence do it in bulk:
- Always-locked roles — check a role (e.g. Employee) and everyone with that role is locked regardless of their individual switch. Use this when “all rank-and-file staff are on-site, managers can be remote.”
- Lock new employees — “New Punchwell employees require the office network by default.” New hires are created already locked, so you never forget. (This applies at the moment an employee is created; it doesn’t retroactively lock people who already exist.)
An employee is treated as locked if any of these is true: their personal switch is on, one of their roles is in the always-locked list, or they were created under the lock-new-employees default. The lock only ever adds people — turning the company defaults off doesn’t clear an individual’s switch.
Step 4 — Widen the allowlist: CIDR, ranges, per-office, per-employee
The single office IP from Step 2 is enough for one location. For multiple sites, an IP range, or a specific remote worker, Punchwell builds the allowlist for a locked employee as the union of four sources — meaning an employee may punch from any address in any of them. Adding a source only ever widens access; it never silently removes the office IPs you already entered. Legacy single-office installs are unchanged.
The four sources:
| Source | Where you set it | Scope |
|---|---|---|
| 1. Office IP(s) | Punchwell → Attendance → Configuration | Everyone (the addresses from Step 2) |
| 2. Additional allowed networks | Punchwell → Settings → IP & Geofence | Everyone (CIDR blocks & ranges) |
| 3. Office / location IPs | Punchwell → Structure → Locations | Employees assigned to that office |
| 4. Additional allowed IPs | The employee’s profile | That one employee |
Exact IPs, CIDR blocks, and ranges
Everywhere you enter an allowlist, you can use three formats (IPv4 and IPv6):
- Exact IP —
203.0.113.5 - CIDR block —
203.0.113.0/24allows the whole203.0.113.*block (256 addresses) in one line. This is the clean way to cover a dynamic IP that moves within a known block, or a larger office subnet. IPv6 works too:2001:db8::/48. - Range —
198.51.100.10-198.51.100.40(or the shorthand198.51.100.10-40) allows every address between the two, inclusive.
What is CIDR? It’s a way to write “this whole block of addresses” without listing each one.
203.0.113.0/24means “any address starting203.0.113.” The/24is the size — bigger number = smaller block. If your ISP gave you a block, this is how you allow it in a single line.
Company-wide CIDR/ranges (source 2). Under Punchwell → Settings → IP & Geofence → Additional allowed networks, enter one entry per line. These apply to every locked employee, on top of the exact office IPs:
203.0.113.0/24
198.51.100.10-198.51.100.40
2001:db8::/48
Unparseable lines are validated and dropped on save, so a typo can’t silently open the door to nothing — but always confirm the entry you wanted is still listed after saving.
Per-office IPs (multiple sites)
If you run more than one location, give each office its own addresses under Punchwell → Structure → Locations (each location row has an IP field). Then assign each employee to their office on the profile (Office / location, also under Punchwell Attendance Settings). A locked employee assigned to “Downtown Store” can then punch from Downtown’s IPs and the company-wide IPs — but a CIDR you only want at one site stays scoped to that site. This is the per-office depth most cheap time clocks don’t offer.
Per-employee IPs (a specific remote worker)
For one person who legitimately works from a fixed remote spot — a home office, a satellite desk — open their profile, find Additional allowed IPs under Punchwell Attendance Settings, and add their address (one entry per line; exact IP, CIDR, or range). It’s added on top of the company and office lists, for that employee only. This lets you keep someone IP-locked (so they still can’t punch from just anywhere) while allowing the one extra place they actually work.
Step 5 — Choose an enforcement mode
Under Punchwell → Settings → IP & Geofence → Enforcement mode, pick how strictly an off-network punch is handled. This setting is company-wide and applies to every locked employee.
| Mode | What happens on an off-network punch |
|---|---|
| Block (default) | The punch is refused. The employee sees a message naming their current IP. This is the hard lock. |
| Warn | The punch is allowed, and the off-site attempt is recorded against the employee. |
| Flag | The punch is allowed, and the off-site attempt is recorded — and the hrm_offsite_clockin_attempt action fires so an integration can react. |
Honest note on Warn vs. Flag: functionally they behave the same — neither one blocks the punch. Both let the punch through and record an off-site marker on the employee (visible to your own tooling/hooks). “Flag” additionally exposes the event to a developer hook. If you want punches actually stopped, use Block. Use Warn/Flag when you’re piloting the feature and want to see who would be blocked before you turn on the hard lock, or when you want a soft audit trail rather than a wall.
Regardless of mode, an off-network attempt always fires the
hrm_offsite_clockin_attemptaction and (if enabled) sends the blocked-attempt email — so you can monitor attempts even in Warn/Flag.
Blocked-attempt email (optional)
Still under IP & Geofence, enable “Email an administrator when an off-site clock-in is blocked” and set a recipient (defaults to your site admin email). HR gets a note when someone tries to punch from off-network — useful for spotting a pattern.
Step 6 — Clock-in time window (optional)
If you also want to refuse punches outside working hours — say, nobody should clock in at 3 a.m. — enable the Clock-in time window under IP & Geofence: “Only allow clock-in/out between” a start and end time. Punches outside the window are refused. It honors your HR timezone (set under Punchwell → Settings → General), and a window that spans midnight (e.g. 22:00–06:00) is supported.
Important and deliberate: the time window restricts clock-IN only. It never blocks clock-OUT. A shift that runs past the window can always be closed — Punchwell will never strand an employee with an open punch they can’t end. (The same principle applies throughout: the office-IP lock does apply to both punch-in and punch-out, but the time window and the GPS-distance check are clock-in-only by design.)
How enforcement actually works (the honest version)
So you know exactly what the lock does and doesn’t guarantee:
- The check runs server-side, at punch time. When a locked employee punches in or out, Punchwell compares the network address the request arrives from (the server’s
REMOTE_ADDR) against the union allowlist. If it doesn’t match and the mode is Block, the punch is rejected before any attendance row is written. The decision happens on your server — it can’t be skipped by a tampered browser, a fake app, or a spoofed GPS coordinate. - It checks the network, not the device or the person. The lock proves the punch came from an allowed network. It does not prove who is sitting at the keyboard. Buddy punching from the office floor (one on-site employee punching for another) is a different problem — pair the IP lock with the kiosk PIN clock or unique logins for that.
- Behind a reverse proxy / Cloudflare? Punchwell uses
REMOTE_ADDRas the authoritative source. If your site sits behind a proxy or CDN, the address Punchwell sees may be the proxy’s, not the visitor’s — so confirm what the Use this IP helper reports matches a real office address, and configure trusted proxies if needed. Don’t trust a forwarded header blindly; that’s how IP locks get spoofed. - The lock applies wherever punches come from — the back-office app, the
[hrm_clock]widget, the mobile/PWA punch screen, and the kiosk — because every one of those posts to the same base punch action. There’s no side door. - GPS is a deterrent, not proof. The optional GPS geofence pairs with this lock and honors the same Block/Warn/Flag mode, but a phone’s location can be spoofed and is imprecise indoors, so a weak/missing GPS fix is never used to hard-lock a real worker out. The IP lock is the hard control; treat the geofence as belt-and-suspenders.
Troubleshooting: “punch refused”
When a punch is rejected, the message tells you which check failed. Match it below.
“You must be on the office network to clock in or out. Your current IP address (x.x.x.x) is not on the allowed list.”
The lock is working as intended — this employee is locked and is punching from an address that isn’t on the allowlist.
- Compare the IP shown in the message with what’s in your allowlist. If the employee is on-site, your office’s public IP probably changed (dynamic IP) or you entered a private
192.168.xaddress by mistake. Use the Use this IP helper on-site to capture the real current address and add it (or allow the whole block with a CIDR — see Step 4). - If they’re behind a proxy/VPN/CDN, the IP Punchwell sees may not be the office IP. Disable the VPN, or add the address Punchwell actually reports.
“This account requires clocking in from an office network, but no office IP addresses have been configured. Please contact your administrator.”
The employee is flagged office-only but no IPs are on file anywhere — so the allowlist is empty and everything is refused. Add at least one office IP under Punchwell → Attendance → Configuration (Step 2). This is the most common setup mistake.
“Clock-in is only allowed between HH:MM and HH:MM.”
The clock-in time window is on and it’s outside the allowed hours. Widen the window, confirm your HR timezone is correct (a wrong timezone shifts the window), or disable the window if you didn’t mean to use it. Remember this blocks clock-in only — clock-out is never affected.
The lock seems to do nothing — off-site punches go through.
- Check the Enforcement mode: Warn and Flag both allow the punch by design. Switch to Block to actually refuse off-network punches.
- Confirm the employee is actually flagged (Punchwell → IP Restrictions toggle on, or the always-locked role / lock-new-employees default applies to them). Unflagged employees can clock in from anywhere — that’s expected.
A specific remote employee keeps getting blocked but should be allowed.
Either turn their personal switch off (if they don’t need locking at all), or keep them locked and add their fixed remote address under Additional allowed IPs on their profile (Step 4).
If clock-in is refused with a message about department or shift policy rather than IP, that’s a different prerequisite — see Clock-In Prerequisites.
FAQ
Is the IP lock on for everyone by default?
No. It’s off for every employee until you flag them (or set an always-locked role / lock-new-employees default). Unflagged employees clock in from anywhere.
Does the lock apply to clock-OUT too?
Yes — the office-IP check applies to both punch-in and punch-out, so a locked employee can’t end their shift from off-network either. (The separate time window and GPS distance checks are clock-in-only, so you never strand an open punch.)
My office IP changes every so often. What do I do?
Either get a static IP from your ISP, or allow your whole ISP-assigned block with a CIDR entry (e.g. 203.0.113.0/24) so the lock still works as the address drifts within that block.
Can one person be locked but allowed to also punch from home?
Yes. Keep their per-employee switch on, then add their home address under Additional allowed IPs on their profile. They stay locked everywhere else.
We have several offices. Do I list every IP globally?
You can, but it’s cleaner to set each office’s IPs under Punchwell → Structure → Locations and assign each employee to their office. Punchwell then allows each person their office’s IPs plus any company-wide ones — the allowlist is the union.
Does this stop one on-site employee punching for another?
Not by itself — the IP lock proves the network, not the person. To stop on-floor buddy punching, pair it with the kiosk PIN clock or individual logins.
Will the GPS geofence replace the IP lock?
No — they complement each other and honor the same Block/Warn/Flag mode. GPS can be spoofed, so treat it as a deterrent; the IP lock is the hard control. See GPS Geofence.
Related
- GPS Geofence — distance-based clock-in check that pairs with the IP lock
- Kiosk Clock — shared wall-tablet punch with code + PIN
- Clock-In Prerequisites — role, department, and shift policy required before anyone can punch
- Settings Overview — the full IP & Geofence and Attendance settings hub