I have an ASP.NET site hosted on GoDaddy Plesk. I'm restricting site access using a whitelist of IP addresses to prevent web crawlers from seeing it, but the clients who need to see the site have residential internet service with a non-static IP address. Is there a way to give them access without removing the whitelist altogether? They can always purchase static IP from the ISP, but for $15/month, I'd like to see if there's a viable, free/cheaper option.
Most broadband providers provide dynamic IP addresses so whitelisting is not realistic and one of the reasons why generally people don't use it. You will not be able to blacklist and whitelist in this manner but you can whitelist an IP range since most internet providers will allocate C class IP addresses to the area where the user is accessing the service from.
To understand C class IP addresses here is a quick rundown:
A.B.C.D, so if the the user has an IP address of
184.108.40.206 the C class would be
1, so you could allow just
24.115.1.* which means
220.127.116.11. But some ISPS run with many C class IP addresses in some areas, especially if they are DENSE populated ones, so you need to monitor it and keep adding them as they appear, eventually you will catch them all, until the ISP adds more to that area.
But there's no need to restrict by IP address
Plesk is not the weakest link, most hackers won't even attempt it if the Plesk is updated regularly and becomes near impossible to hack without a 0-day hack which most often that would be sold to intelligence services anyhow! (cough tinfoil hat).
If you want to lock down your Plesk, do yourself and your users a favor by enforcing Plesk users to use two-way authentication, Plesk has several plugins that allow this, i.e Plesk, Google two-way authentication.