Block IP addresses and stop image hotlinking in cPanel

cPanel has two simple tools for unwanted traffic. IP Blocker denies chosen visitors access to your website, and Hotlink Protection stops other sites from displaying your images or files directly from your server. Both write rules to your .htaccess file, so they work immediately with Apache and LiteSpeed.

Before you start

• Access to cPanel.
• The IP address to block. Find it in cPanel → Metrics → Visitors or Raw Access logs, or check your own with the IP checker so you never block yourself.

Block an IP address with IP Blocker

1. Open cPanel → Security → IP Blocker.
2. In IP Address or Domain, enter one of these formats:
   • Single IP: 203.0.113.25
   • Range: 203.0.113.10-203.0.113.50
   • CIDR: 203.0.113.0/24
   • Implied range: 203.0.113.
   • Hostname: bad.example.com (cPanel resolves it to an IP once)
3. Click Add.

Blocked visitors get a 403 Forbidden error on every site in the account. To unblock, find the entry under Currently-Blocked IP Addresses and click Delete.

Enable Hotlink Protection

1. Open cPanel → Security → Hotlink Protection.
2. Click Enable.
3. Check URLs to allow access. Your own domains are listed; add any other site that may embed your files, such as a CDN hostname.
4. In Block direct access for the following extensions, keep the image types (jpg,jpeg,gif,png,bmp,webp) and add others you want to protect, for example mp4,pdf.
5. Leave Allow direct requests ticked so people can still open a file by typing its URL.
6. Optionally set Redirect the request to the following URL to a small placeholder image.
7. Click Submit.

Check it works

• Open your site from a different network or phone: it should load normally.
• Embed one of your images on a test page on another domain: it should not display.

Troubleshooting

• You blocked yourself: log in to cPanel from another network or ask support to remove the rule; cPanel itself stays reachable.
• Images break after enabling hotlink protection: add every domain and subdomain you use, including www and CDN hostnames, to the allow list.
• Rules vanish: a plugin that rewrites .htaccess may have removed them; add them again.

Next steps

• Write your own .htaccess security rules
• Understand ModSecurity
• Password protect a directory