Whitelist

A whitelist, in information technology, is a list or database of entities that are explicitly granted access to a system, resource, or service. Items on the list are allowed by default to perform the specified action, while others are blocked or denied. The term is widely used in security contexts such as email filtering, network access control, and software whitelisting.

Historically the term derives from color-coded lists, with white representing permitted items and black representing disallowed ones. In recent years, many organizations have adopted neutral alternatives such as allowlist and denylist to avoid racial connotations and to reflect the functional meaning more clearly.

Common applications include email allowlists that bypass spam filtering for approved senders; IP allowlists that permit access only from trusted addresses; domain allowlists and content allowlists; and application or software whitelists used by endpoint protection to permit only approved programs to run.

A whitelist is typically maintained by a policy or a management system. Access or execution is granted to items on the list, while all others are blocked by default or require exception procedures. Regular updates, vetting processes, and automation help keep the list accurate; however, over-reliance on whitelisting can create maintenance overhead and potential blind spots if legitimate items are not added.

Critics note that static lists can be brittle and may entrench access issues if used as a universal model. In modern security practice, whitelisting is often used in conjunction with other controls and is a core principle of zero trust architectures, which restrict access by default and require continuous verification.

See also: blacklist, allowlist, denylist.