Kademi automatically blocks traffic that looks like an attack. Security testing tools look exactly like an attack, so when you hire a company to run a penetration test (a "pen test") or a vulnerability scan on your website, Kademi will block them within minutes.

To stop that, you can put your testers' internet addresses on a whitelist - a list of addresses that are allowed through - for the time the test runs. You can do this yourself, whenever you need to, with no need to contact Kademi support.

Before you start

You will need:

• Administrator access to your Kademi account.
• Your testers' IP addresses. Ask your testing company for the internet (IP) addresses they will test from. They may give you single addresses, like 203.0.113.10, or ranges, like 198.51.100.0/24. Either is fine.
• The dates and times of the test. A whitelist lasts at most 72 hours, so your test needs to fit within that.

Part 1 - Create the whitelist

Open the main menu (1), then go to Websites & apps (2) and choose Websites (3).

Find the website that will be tested and click the pencil button next to it (4). Clicking the website's name opens the website itself, which is not what you want here.

Click the Security tab. It is the one with the padlock icon (5).

Scroll down to Temporary IP Whitelists and click the + button (6).

Fill in the form:

• IP addresses (7) - the single addresses your testers gave you, one on each line.
• CIDR ranges (8) - any ranges they gave you (the ones ending in something like /24), one on each line. Fill in either box, or both.
• Starts and Ends (9) - when the test runs. The form shows how long that is, and will not let you go over 72 hours. Times are in your computer's time zone, so if your testers are in another country, convert their times to yours first.
• Reason (10) - who is testing and why, for example "Acme Security pen test". This helps anyone who looks at the whitelist later.

Then click Add whitelist (11).

Your whitelist now appears in the list. It shows a green Active label while it is switched on. It switches on at the start time and off at the end time by itself, so you can set it up days in advance.

To switch it off early, click the × button on its row.

Part 2 - Let whitelisted addresses past your website's security rules

Your website also has its own set of security rules, called its IDP policy (IDP stands for "intrusion detection and prevention"). The whitelist from Part 1 does not change these rules, so they can still block your testers. Here you add one rule to them.

There are two ways to do this:

• Option A - follow the whitelist (recommended). The rule lets through whichever addresses are on an active whitelist for this website. You set it up once and leave it in place: it switches on and off with your whitelists, so there is nothing to retype and nothing to remove after the test.
• Option B - type in the addresses. The rule lets through the addresses you type into it. It does not switch off on its own, so you must remove it when the test is over.

Steps 1 to 3 are the same for both options.

On the same Security tab, scroll down to Intrusion detection and prevention and click Manage IDP policy (1). The rules listed below that button are the ones that would otherwise still block your testers.

On the Rules tab, click Add rule (2).

Under When, click Set (3).

Option A - follow the whitelist

From the list, choose IP is whitelisted for this website (4). There is nothing else to fill in.

Under Then, click Add and choose Allow and stop checking (5). Then click Apply (6).

Your new rule is added at the bottom of the list. Rules are checked from the top down, and a blocking rule above yours would still stop your testers. Click your rule's up arrow (7) until it is first in the list.

There is no Save button - every change is saved as you make it. When you are done, your rule should be at the top:

That's it. You only need to do this once for each website: next time you need a whitelist on this website, Part 1 is all you need.

Option B - type in the addresses

Follow Option A, but at step 4 choose IP is in known list, IPs or ranges instead. Leave IP list empty, type the same addresses into IPs and the same ranges into Ranges, exactly as you did in Part 1, and click OK. Then carry on from step 5.

Remember to remove this rule after the test - see After the test.

Check it works

Before the test starts, ask your testers to open your website from the computers they will test from. If they are blocked, check that:

• the whitelist shows Active (if not, check the start and end times, and their time zone);
• the addresses match what the testers gave you (and, if you used Option B, that they match in both Part 1 and Part 2);
• the rule from Part 2 is first in the list.

After the test

The whitelist from Part 1 switches itself off at its end time.

If you used Option A, there is nothing else to do. Leave the rule in place for next time.

If you used Option B, that rule does not switch itself off, and it will keep letting those addresses through until you remove it. Go back to Manage IDP policy and click the × on your rule to remove it.

Good to know

• One website at a time. A whitelist covers only the website you created it on, but it covers every address that website can be reached on. If the test covers more than one website, create a whitelist on each of them, and make sure each one has the Part 2 rule.
• Websites that forward to another website cannot have their own whitelist. Set it up on the website they forward to.
• The admin console is not covered. Whitelists only apply to websites. The admin console cannot be whitelisted.
• Longer tests. A whitelist lasts at most 72 hours. If your test needs to run for longer, please contact Kademi support before you book it.
• It is recorded. Creating and removing a whitelist is recorded in your account's audit log, along with the reason you gave.

Before your testers start

Please make sure your testing company knows the following:

• Too much traffic gets the whitelist removed. If the testing puts too much load on our servers, we will remove the whitelist straight away, without warning, and tell you afterwards. This protects the other customers who share the platform. Ask your testers to limit how fast their automated scans run.
• The whitelist only lets the testers in. It does not give them permission to test anything beyond what your organisation has agreed with them.

Questions

If you are not sure whether your test is covered, or your testers are still blocked after you have checked everything above, raise a Support Request and we will help.