Office-IP Time Clock Lock for WordPress

If an employee isn’t on your office network, they can’t clock in. That’s the whole idea — and Punchwell enforces it server-side, so a punch from a phone at home or a buddy covering a no-show is refused, not just logged.

Most cheap time clocks record where a punch came from and let it through anyway. Punchwell’s office-IP lock is the hard control: flag any employee as office-only, and they can punch in or out only from an address you’ve allowed. No app to install, no location to fake from the couch.

Get Punchwell Pro — $99/yr → · See how it works ↓

Free on WordPress.org. Per site, not per seat. Your data stays on your server.

Buddy punching is payroll leaking out the back door

When one cashier clocks in for a friend who’s running late — or a remote-capable worker punches from home on a day they’re supposed to be on the floor — you’re paying for hours nobody worked. It’s quiet, it’s routine, and most time clocks make it easy.

You’re exposed if you run an hourly, shift, or on-site team and you can’t actually prove people were in the building when they clocked in:

Retail shops & franchises — registers staffed by the clock, not the schedule.
Clinics & dental practices — front-desk and clinical staff who must be on-site, with patient-data privacy on top.
Restaurants & cafés — high turnover, shared devices, easy phone punches.
Warehouses & call centers — large floors where a few minutes per person per day adds up fast.
Salons, gyms & agencies — small teams where one disputed timesheet sours the whole month.

Plenty of tools “geofence” the punch — but GPS needs an app and can be spoofed from anywhere. An office-IP lock can’t be faked from a phone at home: either the device is on your network, or the punch doesn’t happen. That’s the difference between recording time theft and preventing it.

How the office-IP lock works

It’s three plain steps, and it lives entirely inside the WordPress site you already run.

Punchwell reads the public IP the device is punching from — your office’s internet-facing address, not a 192.168.x LAN number. A one-click “Use this IP” helper grabs it for you on every IP-entry screen, so you’re not hunting through router settings.
You flag the employees who must be on-site. It’s a single per-employee setting (stored as a WordPress user meta flag). On-site cashiers get locked to the building; a remote bookkeeper stays unlocked and can punch from anywhere. Your call, per person.
Every punch is checked server-side. When a flagged employee tries to clock in, Punchwell compares their address to your allowlist before accepting anything. Off-network, in Block mode, the punch is refused — it never lands in the timesheet. This runs in the plugin’s core attendance validation, not in the browser, so there’s nothing on the device to disable or trick.

Because employees are WordPress users, there’s nothing new to learn and no separate system to sync. The lock is just another setting on the profile.

See the full feature tour →

Allowlist depth almost nobody else ships

A single office IP is the starting point. Real businesses have more than one door, so Punchwell lets you describe “the office” exactly:

Exact IPs — list individual addresses one by one.
CIDR blocks — allow a whole range at once. A block like 203.0.113.0/24 covers every address in that subnet without you typing 256 lines.
Address ranges — a plain start-to-end span when CIDR isn’t the natural fit.
IPv4 and IPv6 — both are supported.

And you can set those allowances at three scopes that combine into one:

Company-wide — addresses every locked employee can use.
Per-office — each location in your Structure → Locations list carries its own IPs, so a second branch’s network is trusted only for that branch’s people.
Per-employee — an “Additional allowed IPs” field on the profile for the one person who genuinely needs an extra address.

Here’s the important part: these scopes are unioned, and they only ever widen access. Adding an IP somewhere can let more punches through — never fewer. So a legacy single-office setup keeps working exactly as it did, and you grow the allowlist without fear of accidentally locking out half your floor.

Allowed for an employee  =  company IPs
                          ∪  their assigned office's IPs
                          ∪  their own extra IPs

This is the depth that separates Punchwell from a checkbox. See how it stacks up against other time clocks →.

Enforcement modes: as strict or as soft as you want

Locking the clock doesn’t have to mean slamming a door on day one. Punchwell gives you three modes:

Block — the hard control. Off-network punches are refused server-side. Use this once you’re confident in your allowlist.
Warn — the punch is allowed but noted, so you can roll the lock out gradually and watch what would have been blocked before you tighten it.
Flag — the punch is allowed and silently marked for review.

(Honest note: Warn and Flag behave the same way at punch time — neither blocks. They’re your “observe first” settings. Block is the one that actually stops the punch.)

On top of the modes, you get controls that close the common gaps:

Clock-in time windows — optionally accept punches only during a window around shift start, so nobody pre-clocks an hour early. It’s direction-aware: it never blocks a clock-out, so people can always end their shift.
Blocked-attempt emails — when an off-site punch is refused, HR gets an email, so a pattern of attempts doesn’t go unnoticed.
Lock-by-role and default-lock new employees — auto-apply the office-IP requirement to a whole role, or to everyone you hire from now on, so nobody slips through unlocked.

Every one of these defaults to off. Turn the lock on when you’re ready; until then, nothing about your existing setup changes.

Beyond IP: GPS geofence, kiosk, and a mobile punch

The IP lock is the hard control, but it isn’t the only way to clock in. Layer on whichever fits how your team actually works:

GPS geofence — for staff who legitimately move (a delivery driver, a home-visit nurse), check a punch against a work-site fence: company-wide or per-office, each with its own location and radius (set in metres or feet). It honors the same Block/Warn/Flag modes, never blocks a clock-out by distance, and lets a punch through when the GPS fix is weak so you don’t strand a real worker. Treat it as a deterrent, not proof of presence — GPS can be spoofed, which is exactly why the IP lock exists.
Kiosk clock — turn a wall tablet at the entrance into a shared clock. Employees punch with a short code and 6-digit PIN — no individual logins on the device — and the venue’s IP still has to match your allowlist.
Mobile / PWA punch — a responsive web punch screen employees add to their home screen like an app (no App Store download; it needs HTTPS). Pair it with the GPS geofence for off-site crews, or keep it inside the IP lock for on-site staff.

So the real story is: IP lock and GPS geofence and kiosk and mobile punch — softer or stricter, your call. Most tools make you pick one approach. Punchwell lets you mix them per situation.

Explore employee self-service & mobile punch →

Why most cheap time clocks can’t do this

This isn’t a knock on scheduling tools — it’s an honest look at what they enforce.

Homebase, Deputy, When I Work, Connecteam, Jibble do GPS geofencing only. There’s no IP lock at all. GPS needs an app and can be spoofed from a phone anywhere, so it logs a location rather than guaranteeing presence. And they bill per head — a 25-staff shop runs roughly $1,950/yr for Deputy and around $2,100/yr for When I Work.
Buddy Punch genuinely does ship IP restriction (and it’s a capable product) — but it’s per-user SaaS, around $19/mo plus roughly $4.49–10.99 per user per month, and your timesheets live in their cloud. For 25 staff that’s about $1,520/yr. Punchwell is self-hosted, flat-priced, unlimited employees, your data on your server, with deeper IP control: CIDR and address ranges, per-office and per-employee allowlists, and block/warn/flag modes.
WP ERP, the closest WordPress competitor, does have an attendance IP whitelist — but it’s global only: it’s everyone or no one. There’s no way to lock the front-desk team to the building while remote staff punch from home. WP ERP also stacks up — Pro plus $3/user/year plus à-la-carte Attendance and Payroll modules at their own monthly fees — and crosses $99/yr at about three users.

Punchwell is $99/year per site, unlimited employees, never per seat. A 25-person shop pays the same flat price as a 5-person one.

(Competitor prices are approximate, as of June 2026; vendors change pricing — confirm current rates before relying on them.)

Compare Punchwell to Buddy Punch, Deputy & WP ERP → · See full pricing →

FAQ

Does it actually block the punch, or just log where it came from? It blocks it. In Block mode, a flagged employee punching from outside your allowlist is refused server-side — the punch never enters the timesheet. This runs inside Punchwell’s core attendance validation, not in the browser, so there’s nothing on the device to switch off. Warn and Flag modes let punches through (for observe-first rollouts); Block is the hard stop.

Can someone fake their IP from home with a VPN? A VPN can change what address a device appears to come from, but it can’t put that device on your private office network — and that’s what the lock checks against your allowlist. Unlike GPS, which an app can spoof from a couch, an office-IP lock can’t be faked from outside your network. We don’t claim it’s unhackable; we claim it refuses the punch server-side, which is a real, enforced control rather than a logged location.

What if my office has more than one internet connection or location? That’s exactly what the allowlist depth is for. Add multiple exact IPs, a CIDR block like 203.0.113.0/24, or an address range; give each location in Structure → Locations its own IPs; and add a per-employee address for the rare exception. The scopes combine, and adding an IP only ever widens access — so you can’t accidentally lock people out by adding more.

Can I lock some employees but not others? Yes — it’s a per-employee setting. Lock your on-site cashiers and front-desk staff to the building while a remote bookkeeper or a field rep punches from anywhere (optionally with a GPS geofence instead). You can also auto-apply the lock to a whole role, or to every new hire from now on.

Do employees need to install an app? No native app required. They punch from the web — a normal browser, the kiosk tablet at the entrance, or the mobile punch screen they can add to their home screen like an app (it’s a PWA, not an App Store download). The IP lock works the same across all of them.

Is this hosted in your cloud? No. Punchwell is self-hosted inside the WordPress site you already run. Your employee and attendance data stays in your own database — no cloud holds your timesheets and there is no data call-home — the free version makes no outbound calls at all (verified), Pro’s only outbound call is license validation (never your data), and the only external content is optional YouTube tutorial embeds and Gravatar avatars. More on owning your data →

Lock the clock this week

Start free on WordPress.org with the basic single-office IP lock, or get the full per-employee, per-office depth — CIDR and ranges, block/warn/flag modes, GPS geofence, kiosk, and mobile punch — in Pro for $99/year, one site, unlimited employees.

Get Punchwell Pro — $99/yr → · Download the free version →

Per site, never per seat. Renewal price locked if you never lapse. GPL, self-hosted, your data stays on your server.

Already running the old, abandoned plugin? Follow the migration guide → — your employees, attendance, and leave records carry over.

Punchwell is an independent, third-party maintained fork of the GPL-licensed “WP Human Resource Management” plugin. Sturdyhaus is not affiliated with, endorsed by, or sponsored by wpspear, weDevs, or the original author. Product names are referenced descriptively only. Punchwell, by Sturdyhaus.

Office-IP Time Clock Lock for WordPress | Punchwell