How to block an IP address in cPanel

This guide shows how to stop a particular IP address, or a range of addresses, from loading your website using IP Blocker in cPanel. It also covers how to find the address to block and when blocking won’t help.

Find the IP address first

You need the address of whoever is causing the problem. Two places in cPanel show it.

Visitors

1. Log in to cPanel.
2. In the Metrics section, open Visitors.
3. Click the magnifying glass next to your domain.
4. You’ll see the most recent requests, each with the IP address, the time and the page asked for.

Raw Access

1. In Metrics, open Raw Access.
2. Click your domain to download its access log. It’s a compressed file you can open with most unzip tools.
3. Open the log in a text editor. Each line starts with the IP address. Look for one address making hundreds of requests, or repeatedly asking for login pages such as wp-login.php or xmlrpc.php.

For more on what these logs show, see how to see visitor stats in cPanel.

Block an address or range

1. In cPanel, go to the Security section and open IP Blocker.
2. In the Add an IP or Range box, type the address. You can enter:
   • one address, such as 203.0.113.45
   • a range written as a start and end, such as 203.0.113.1-203.0.113.254
   • a range in CIDR form, such as 203.0.113.0/24
   • a partial address, such as 203.0.113., which covers everything starting with those numbers
3. Click Add.

The address now appears under Currently Blocked IP Addresses. Anyone visiting from it gets a “403 Forbidden” error instead of your site.

To unblock it later, click Delete next to the entry in that list and confirm.

What the block covers

IP Blocker writes deny rules into the .htaccess file in your account. That means it stops web traffic to your site. It doesn’t stop the address sending you email, and it doesn’t affect FTP or SSH. If you edit .htaccess by hand later, leave the lines IP Blocker added in place or the block will stop working.

Be careful with large ranges. A whole /16 range can include thousands of ordinary home or mobile users, and you might lock out real customers, or yourself.

When blocking won’t help

Blocking works well against one fixed address, such as a scraper running on a single server. It does little in these cases:

• The attacker keeps changing address. Botnets and most password-guessing attacks come from thousands of different machines. Blocking them one at a time is a losing game.
• The person is on mobile data or home broadband. Their address often changes when they reconnect, and the old one may pass to someone else.
• They use a VPN or proxy. They can switch to another server in seconds.

For WordPress login attacks, a security plugin with login limits, plus two-factor sign-in, does more good. See how to secure WordPress. Our servers also run Imunify360, which blocks a lot of known bad traffic before it reaches your site.

Using Cloudflare instead

If your domain runs through Cloudflare, visitors reach our server through Cloudflare’s network, so a block on our side may not catch them. It’s more reliable to block the address in your Cloudflare dashboard instead. Cloudflare’s firewall rules can also block whole countries or challenge suspicious traffic, which helps against attacks from many addresses. See how to use Cloudflare with your hosting.

If it doesn’t work

• The visitor can still reach the site. Check you blocked the right address and that it hasn’t changed. If you use Cloudflare, see the section above.
• You’ve locked yourself out. Find your own address by searching “what is my IP” from another connection, then delete that entry in IP Blocker. If you can’t reach cPanel either, ask us in a ticket.
• Your site shows a 500 error after adding a block. The .htaccess file may have a conflicting rule. See how to find error logs in cPanel.

Still stuck? Open a support ticket and we’ll help.