When a customer says cPanel, email or the website stopped working only from their office, LFD has usually blocked their IP after failed logins. This guide shows how to confirm the block, read the reason and remove it from WHM.
Before you start
- Root or WHM access to a server running CSF.
- The customer's public IP. Ask them to open the IP checker and send you the address.
- If you are a hosting customer rather than the server owner, you cannot do this yourself; follow why is my IP blocked and contact support.
Search for the IP in WHM
- Open WHM → Plugins → ConfigServer Security & Firewall.
- In Search for IP, enter the address and click Search for IP.
- The result shows the matching rule and its comment, for example lfd: (smtpauth) Failed SMTP AUTH login from 198.51.100.7: 5 in the last 3600 secs.
The comment tells you which service triggered the block, so you can help the customer fix the cause.
| Reason in comment | Usual cause |
|---|---|
sshd | Wrong SSH password or key. |
cpanel / whm | Wrong cPanel password, saved old password in a browser. |
smtpauth / imapd / pop3d | Mail app with an old password after a password change. |
ftpd | FTP client with wrong credentials. |
CT_LIMIT / PORTFLOOD | Too many connections at once. |
Remove the block
- In the search result, click the unlock/delete icon next to the rule, or use Quick Unblock with the IP.
- From SSH, the same thing is:
csf -dr 198.51.100.7csf -tr 198.51.100.7 - Search again to confirm no rule remains.
Note: If CSF has no entry, the block may come from cPHulk, Imunify360 or ModSecurity. Check cPHulk and Imunify360 blocked IPs.
Stop it happening again
- Ask the customer to update the saved password in every mail app and phone. An old password on one device will block the whole office.
- For a trusted static office IP, add it to
csf.ignoreso LFD will not block it, or allow it. See allow, deny and temporary bans in CSF. - If many genuine users are blocked, raise the matching
LF_trigger slightly; see tune LFD alerts and blocking.
Troubleshooting
- The IP is blocked again within minutes: a device is still retrying with a bad password. The LFD log shows each failure:
grep 198.51.100.7 /var/log/lfd.log. - Unblocked but still cannot connect: the customer's own network may block ports such as 2083 or 465. Ask them to test from mobile data.