The Imunify360 firewall decides which IP addresses can reach the server. It keeps three lists: the white list (always allowed), the black list (always blocked) and the grey list (challenged with a CAPTCHA). Knowing how they work helps you decide when to ask for an IP to be whitelisted.
Before you start
- The IP address you want to whitelist (from the IP checker), and whether it is static.
- A reason, such as your office, a payment gateway callback or an uptime monitor.
The three lists
| List | Effect | How IPs get there |
|---|---|---|
| White list | Never blocked by the firewall or brute-force protection | Added by the server administrator |
| Grey list | Websites show a CAPTCHA; other services are blocked until it is passed | Automatically, after suspicious activity |
| Black list | All access blocked | Administrator or reputation feeds |
There are also automatic temporary blocks after failed logins (see unblocking an IP).
Where the lists are managed
On a server you control, the lists are in WHM → Plugins → Imunify360 → Firewall, with tabs for White List, Grey List and Black List. Each entry has an IP or subnet, an optional expiry and a comment.
On MdmHost shared, reseller and master reseller hosting, the firewall is server-wide and managed by MdmHost, so customers and resellers request changes through support. This keeps one customer's whitelist from opening the server to attackers.
Note: The tabs you see in Imunify360 depend on the server's settings and your package. If a tab in this guide is missing, that action is handled by MdmHost support.
Request a whitelist on MdmHost
- Confirm the IP is static. Home connections often change IP; whitelisting them helps only briefly.
- Open a support ticket with the IP, the service it needs (website, cPanel, email, FTP) and the reason.
- We review and add it, usually with a comment naming your account.
When whitelisting is a good idea
- A fixed office IP that is repeatedly blocked because many staff share it.
- A monitoring or payment service that must always reach your site, with a published IP list.
- A deployment server that connects via SSH or FTP.
When it is not
- Dynamic home or mobile IPs.
- Shared VPN IPs used by thousands of people.
- To "fix" WAF blocks on a specific form; those are better solved by fixing the rule (see ModSecurity false positives).
Warning: A whitelisted IP bypasses brute-force protection. If that IP is compromised, attackers can try passwords without limits. Always use strong passwords and two-factor authentication, even from whitelisted IPs.
Blacklisting attackers
If a specific IP is attacking your site, such as flooding a contact form, send it to support with log lines from cPanel → Metrics → Raw Access. For your own site only, you can also block it in .htaccess (see .htaccess on LiteSpeed).
Frequently asked questions
Can I whitelist a country?
Country-level rules are server-wide and not available per customer. Ask support if a whole region is attacking your site.
Does whitelisting stop the CAPTCHA?
Yes, whitelisted IPs skip WebShield challenges.