IP Address Logging and Article 5 of the GDPR

IP Address Logging

An IP address is considered personal data if it allows a person to be identified, even indirectly. Recording it does not require the user’s consent if it complies with the rules of the Italian Data Protection Authority and the GDPR.

Storing IP addresses is permitted without consent for cybersecurity purposes, such as blocking attacks or investigating online crimes. In the specific case of WordPress, access to the admin dashboard is subject to numerous daily attacks by bots attempting to gain access using brute-force techniques. Even a perfectly ordinary website can be subject to thousands of login attempts a day simply because IP addresses are scanned completely automatically.

Deskmode Pro Suite
In cases like this, the IP address logging technique  becomes essential to block the sources of attacks at the outset. Our Deskmode Pro Suite plugin was created specifically to perform this task: directly blocking individual attacking IPs or entire IP ranges. Furthermore, through geofencing techniques, it is possible to block access from entire countries (blacklist) or, better yet, grant access only to the countries where the site’s customers reside (whitelist).

From a regulatory standpoint, the logging of IP addresses must not result in the creation of logs that can be retained indefinitely, but only for as long as is strictly necessary to ensure system security or within the limits set by law.

In general, IP addresses are logged and retained for a standard period that typically ranges from 3 to 6 months. This timeframe is considered sufficient to detect systematic threats, analyze recurring patterns, and thereby block malicious IP addresses.