^ matches the head of string, $ matches the tail of string.

This is an anti session hijacking measure that limits how far IP bits can move within a session.

Default 32 bit - all bits are protected (IP cannot change).

If you have a dynamic IP that moves within a known range, you can set the number of protected bits to roughly match.

For example, if your IP can move in the range of 192.168.0.0 to 192.168.0.255, set 24 bit here. If a cracker knew your session IP but tried to access from outside this range (say 192.168.2.50) they would fail.

The author of the module suggests 16 bit as a balanced value for general use.

Anti session hijacking measure. Selected groups are not permitted to change their IP in a session. The default is ‘webmasters’ and it is recommended to leave it that way as the consequences of an administrator’s session getting hijacked could be quite severe.

Enter allowed IPs for group 1 (webmasters) in this box, each on a separate line. You can allow ranges of IPs, for example entering 192.168. will allow 192.168.*