An allowlist is a list of approved items that are permitted to run, connect or be accessed, with everything else blocked by default. It is used for things like applications and scripts, URLs or domains, IP addresses, email senders, file hashes and device IDs. Entries can be exact values, patterns or trusted signatures, and exceptions are added as needed. Common uses include application allowlisting, firewall or API access lists and safe sender lists in email. Compared with a blocklist, which only denies items on the list, an allowlist is stricter and needs more upkeep but gives predictable, controlled behaviour. The term replaces older wording such as ‘whitelist’.
