Sometimes one IP address or network causes trouble: brute-force login attempts, comment spam, scraping your content or using up your resources. cPanel's IP Blocker denies those addresses access to your websites by writing rules into your .htaccess file.
Before you start
- Find the offending IP addresses. Good sources are Metrics → Visitors, Raw Access logs and security plugin reports.
- Make sure you are not about to block yourself. Check your own IP with the IP checker.
Block an IP or range
- Open cPanel → Security → IP Blocker.
- In Add an IP or Range, enter one of the formats below.
- Click Add. The block takes effect immediately for all domains on the account.
| Format | Example | Blocks |
|---|---|---|
| Single IPv4 | 203.0.113.45 | One address |
| Range | 203.0.113.10-203.0.113.60 | All addresses in the range |
| Implied range | 203.0.113.10-60 | Same as above |
| CIDR | 203.0.113.0/24 | 256 addresses (.0 to .255) |
| Implied wildcard | 203.0. | Everything starting with 203.0 |
| IPv6 | 2001:db8::/32 | An IPv6 network |
| Domain name | badhost.example | Its current IP (resolved once) |
Warning: Large ranges can block real visitors who share a mobile or ISP network. Prefer single IPs or small ranges, and review the list every few months.
Remove a block
At the bottom of the IP Blocker page, under Currently-Blocked IP Addresses, click Delete next to the entry and confirm.
What IP Blocker does and does not cover
- It blocks web access (HTTP/HTTPS) to your sites. Blocked visitors see 403 Forbidden.
- It does not block email, FTP or SSH. For mail, use email filters or the SpamAssassin blacklist.
- If your site uses Cloudflare or another proxy, the server sees the proxy's IPs; block visitors in the proxy's firewall instead.
- Server-wide brute-force blocks (for example after failed cPanel logins) are handled by MdmHost's firewall, not IP Blocker. Ask support to remove those.
Alternatives for common cases
- WordPress login attacks: password-protect
wp-adminwith Directory Privacy or limit login attempts with a security plugin. - Bad bots by user agent: an
.htaccessrule matching the user agent catches bots that change IP. - Whole countries: IP Blocker is not designed for country blocking; use a CDN or security plugin with geo rules.
Troubleshooting
- You blocked yourself: connect from another network (mobile data) and remove the entry, or ask support.
- Block does nothing: another
.htaccessin a subfolder may override it, or traffic comes through a proxy. - 500 error after adding: the
.htaccessalready had broken lines; see fix 500 errors.