Definition
IP lock (sometimes called session pinning) is a defense-in-depth policy where a server ties each authenticated session to the IP address it was created from. Any subsequent request from a different IP is rejected and the user must re-authenticate.
The tradeoff is convenience vs. security. Strict IP matching breaks every time a user's IP changes - leaving the office Wi-Fi, switching to a cellular network, failover on a corporate VPN. Relaxed matching (same subnet) tolerates common NAT and DHCP churn while still blocking sessions hijacked to a different geography.
IP lock is not a replacement for other security layers. It complements 2FA and re-auth on destructive actions - together they make a hijacked cookie significantly harder to exploit.
How SheetLinkWP relates to IP Lock
SheetLinkWP exposes three IP lock modes in the portal's Security tab:
- Off (default) - no check. - Relaxed - the current IP must be in the same /24 (IPv4) or /64 (IPv6) as the session-origin IP. Tolerates office NAT and ISP churn. - Strict - exact match only. Use only on a truly static IP.
When a request fails the IP check, the portal returns 401 with needsReauth:true and the user signs back in via a fresh magic link. The setting is per-license; for users with multiple licenses (e.g., a Freelancer and an Agency license), the strictest enabled mode wins. Changing the mode requires a fresh email re-auth code, so an attacker can't disable the lock from inside a hijacked session.