Sometimes a visitor opening a site on MdmHost sees a page asking them to confirm they are human. That page comes from WebShield, part of Imunify360. Instead of blocking a suspicious IP outright, WebShield gives it a challenge, so real people can continue while bots are stopped.
Before you start
No setup is needed; WebShield runs on all MdmHost servers. To help a visitor, ask for their IP address from the IP checker.
How WebShield works
- An IP behaves suspiciously: failed logins, attack-like requests, very high request rates or a poor reputation.
- The firewall puts it on the grey list (see firewall lists).
- When that IP requests any website on the server, WebShield shows a challenge page.
- If the visitor passes, the IP is allowed again for a while. Bots that cannot pass stay blocked.
What visitors see
- A short page with a checkbox, an image CAPTCHA or an automatic JavaScript check.
- After passing, they are taken to the page they requested.
Note: The challenge is about the visitor's IP, not your site. It can appear on any site on the server for that IP.
Good bots and search engines
WebShield recognises verified search engine crawlers such as Googlebot and Bingbot and lets them through, so SEO is not affected. Fake bots that only claim to be Googlebot are challenged.
When real visitors are challenged
- Shared IPs: offices, schools, mobile carriers and VPNs share IPs between many people; one infected device can grey-list everyone.
- Repeated failed logins from that network (see blocked IPs).
- Browser extensions or scrapers making many requests.
Ask the visitor to pass the challenge once. If they cannot (for example JavaScript disabled) or it keeps returning, open a ticket with their IP.
When services you need are challenged
Webhooks, payment gateway callbacks, uptime monitors and API clients cannot solve a CAPTCHA. If one of them stops working:
- Check the service's logs for a 403 or an HTML response instead of the expected data.
- Find the service's published IP range.
- Ask support to whitelist those IPs.
Is the CAPTCHA a sign my site is hacked?
No. It is a sign the visitor's IP looked suspicious. If you are worried about your site, run a scan (see malware scanning).
Frequently asked questions
Can I add my own branding to the CAPTCHA page?
No. The page is generated by Imunify360 at server level and is the same for all sites on the server.
Does WebShield replace a CAPTCHA on my contact form?
No. WebShield works per IP at the server edge. Keep a CAPTCHA or honeypot on forms to stop form spam.
Will a challenged visitor lose their form data?
If the challenge appears in the middle of a form post, the post may need to be resent. This is rare for normal visitors.
Can I test whether my own IP is grey-listed?
If you see the challenge page on any site on the server, your IP is grey-listed. Pass it once, then fix the cause, such as an old saved password.