How to Block an IP Address in cPanel

1. When and why to use IP Blocker

Blocking an IP can help with malicious traffic such as repeated sign-in attempts, spam bots, resource abuse or suspicious scans. Unless you use server-level controls, this usually blocks website access with a 403 Forbidden response, not necessarily email, FTP or other services.

2. Block an IP in cPanel

For: cPanel users without root or WHM access.

• Sign in to cPanel.

• Find IP Blocker

Open the Security section, then click IP Blocker.

• Enter the IP or range to block.

  • In the field Add an IP or Range, enter the address to block, such as 192.168.0.1 in this example.

• • • Accepted formats:

      • Single IP: 203.0.113.45

      • Range: 203.0.113.1-203.0.113.255

      • CIDR block: 203.0.113.0/24

    • Click Add

The address appears under Currently-Blocked IP Addresses

3. Remove or unblock an IP

• Return to IP Blocker in cPanel.

• Find the IP in the Currently Blocked.

• Click Delete, Remove or trash icon beside it.

• Confirm removal.

4. Advanced alternatives

Blocking through .htaccess

For experienced users or when website-specific control is needed.

Example for older Apache versions:

deny from 203.0.113.45 deny from 198.51.100.0/24

Example for Apache 2.4 and later:

<RequireAll> Require all granted Require not ip 192.168.0.1 </RequireAll>

Tips:

• Always back up your .htaccess before editing it.

• Place the relevant rules near the beginning of the file.

• A syntax error can break the website; make changes carefully.

• Use File Manager or FTP to edit the file.

Server-level blocking (WHM)

With WHM access on aVPS or dedicated server), you can configure access rules through Host Access Control.
The affected services depend on the rules and server configuration. Check the specific service rather than assuming a website rule also blocks SSH, FTP and email.
Server-level rules can have a broader effect than website-only blocking.

Use a firewall or security layer

Manually blocking IPs in cPanel may be insufficient during an attack. Tools such as firewalls and security software can detect and block malicious traffic automatically.

Examples include:

CSF (ConfigServer Security & Firewall)

• What it is: A server security tool.

• What it does: Monitors repeated failed sign-ins, such as SSH or cPanel, and can block the relevant IPs.

• Who uses it: VPS or dedicated-server administrators with root access.

• Benefit: Helps reduce password-guessing attacks against the server.

Fail2Ban

• What it is: A server security tool that monitors recurring sign-in failures.

• What it does: Can ban IPs after repeated failed attempts for configured services, such as SSH, FTP or email.

• Who uses it: VPS or dedicated-server administrators.

• Benefit: Helps limit brute-force attacks on server services.

WAF (Web Application Firewall)

• What it is: A firewall operating at the HTTP/HTTPS website layer.

• Examples: Cloudflare, Sucuri and ModSecurity, depending on the hosting service.

• What it does:

  • Filters malicious requests before they reach the application.

  • May block IPs, countries, suspicious bots or attack patterns according to its rules.

  • Helps with malicious web requests and some application-layer attacks. Broader DDoS protection depends on the service.

• Who uses it: Website owners can use it, including on shared hosting when supported by the host or a service such as Cloudflare.

Note:
These tools require appropriate privileges and ongoing maintenance. Original CSF maintenance ended in 2025; cPanel now distributes cpanel-csf. Check the installed package and updates. A WAF protects web traffic according to its rules, not every service or attack.

5. Good practices

• Identify the correct IP:
  Some visitors connect through a proxy or CDN such as Cloudflare. Headers such as X-Forwarded-For can identify client IPs only when supplied through a trusted, correctly configured proxy. Do not trust arbitrary client-supplied headers.

• Avoid unnecessarily broad ranges:
  They can block legitimate users. Use ranges only when justified.

• Choose the appropriate tool:
  For a limited website issue, consider IP Blocker.
  For broader attacks, use suitable firewall or provider protection.

6. Test the IP block

After blocking, check the result:

• Access the website from the blocked address or have its authorized user test it.

• You should see 403 Forbidden or another access-denied response, depending on configuration.

• A VPN tests the blocked address only if its exit IP actually matches that address; an arbitrary VPN connection cannot simulate any chosen IP.