Restrict Access to Your Company Network and Registered Devices

Limiting "where from" shrinks the damage if something leaks

Many companies run their official accounts from office PCs. But the tool itself will open from a home PC or an internet cafe, as long as someone can log in. It is rare for both a password and two-factor authentication to be broken, but gaps in day-to-day practice do happen: a login left on a former employee's device, or someone forgetting to log out of a shared PC.

When you turn access restriction on, the screens for that company or brand open only from an approved IP address or a registered device. Even if login details leak, an unknown device outside your company can't see inside. It is for companies whose internal rules already say "official accounts are operated from inside the company" and want the system to enforce that rule. How to write such rules is covered in How to Write a Social Media Policy.

The restriction is off by default. Only an admin of that company or brand can turn it on, add approvals or remove them.

The settings screen is under "Security" in the company or brand menu.

Allow by IP address

This suits PCs that are used from a fixed IP address, such as your office network. You can enter a single IP address like "203.0.113.10" or a range like "203.0.113.0/24". IPv6 is supported too. Ranges that are too wide are rejected, because they would make the restriction meaningless.

The screen shows the IP address of the device you are using. If you are on a company PC, that value is already filled in, so you only need to give it a name (such as "Head office network") and add it. The list also shows when each approval was last used, so you can spot approvals that are no longer needed and delete them.

On some connections the IP address changes from time to time. Ask your internet provider whether yours is fixed. If it changes, allowing by device (below) is more reliable.

Allow by device

Phones and laptops you carry around get a different IP address depending on where you are. For these, you register the device itself. A registered device keeps a marker in its browser, and while the marker is there it can open SNS TOWN from anywhere. The marker lasts 400 days, but if you clear the browser's data you will need to register again.

To register the PC you are using now, just click "Register this device".

To register another device such as a phone, click "Create a registration link" on a company PC. A link and a QR code appear. Open it on the phone you want to register within 30 minutes, once only. The link stops working after one use, and even if two devices open the same link, only one gets registered. This prevents devices from being added without the admin's knowledge.

If you register the same device for several companies or brands, it still carries just one marker. Each company or brand can have up to 50 approvals in total, counting IP addresses and devices together.

It stops you from locking yourself out

The scariest part of any restriction is that the person setting it up can no longer get in. SNS TOWN will not let you turn the restriction on unless the device you are using is already approved. You will see a message asking you to add this IP address or this device first. When you delete an approval, it also blocks the deletion if that would lock out your current device.

If everyone is locked out anyway, for example because the network changed, contact us. After confirming your identity, we can lift the restriction for you.

What someone sees when they are blocked

If someone tries to open SNS TOWN from a place that isn't approved, they see a screen saying "This device can't open this page." It shows the company or brand name and their current IP address, and tells them to ask an admin for a registration link.

The restriction applies per company or brand. If the same person is also a member of another company or brand with no restriction, they can switch to it from that screen. For example, an agency that manages several clients keeps working for the others even if one client asks for strict restrictions. How to split companies and brands is explained in Keep Companies and Brands Separate.

Use it together with two-factor authentication

On the same "Security" screen, you can also require two-factor authentication for all members. Access restriction checks "where from" and two-factor authentication checks "is it really you", so turning on both layers the protection. Two-factor setup, login-failure lockouts and per-device sign-out are explained in Login Protection.

At the top of the screen, the protection that keeps AI crawlers and automation tools out of the logged-in screens is shown as "always on". Users can't switch it off.

Dividing up what each role can do is another form of protection. People with view-only access can be kept from posting or changing settings (Members and Roles). The overall approach to protection across SNS TOWN is summarized in Security.

How to set it up

1. An admin opens "Security" for the company or brand on a company PC.
2. Under "IP address", add the company network, or click "Register this device" to register the current PC.
3. For people who use phones, click "Create a registration link" and have them open the link on their phone.
4. When the approvals are in place, click "Turn restriction on".

Frequently asked questions