Skip to main content
The IP Blocker writes Deny from <address> rules into your .htaccess for you. The block applies to HTTP and HTTPS traffic for every domain on the account. Open it from cPanel home → Security → IP Blocker.
IP Blocker page with the entry form and active block list

IP Blocker form and the list of currently blocked addresses

​
What you can put in the box

The form accepts a few notations. Mix and match as needed.

​
Block an IP

1

Type the IP, range, or CIDR

Use any of the formats above. cPanel validates the format before accepting it.
2

Click Add

The block is in effect immediately. Anyone hitting your site from a blocked address gets a 403 Forbidden.

​
Remove a block

The list at the bottom of the page shows every active block with a Delete action. Click it. The matching Deny line is stripped from .htaccess and the block lifts within seconds.

​
Block a country

The IP Blocker doesn’t have a country picker. Two ways to do it anyway:
  • Cloudflare WAF. If your domain runs through Cloudflare proxy (orange cloud), use Security → WAF → Custom rules with ip.src.country eq "RU" (replace as needed). Far less invasive than blocking thousands of IPs at the origin.
  • Pre-computed CIDR list. Fetch the country’s IP ranges from a list like ipdeny.com or ipinfo.io. Paste them one CIDR at a time, or open a ticket and we’ll script the bulk add for you.
The .htaccess approach gets unwieldy fast: a country block can be tens of thousands of CIDRs, which slows every request. Cloudflare or a server-level firewall is almost always the better fit.

​
What the IP Blocker does not do

  • It doesn’t stop SSH or FTP. Those run on their own ports and the .htaccess deny rules don’t apply. Block at the firewall via Imunify360 or open a ticket for an iptables rule.
  • It doesn’t stop a determined attacker rotating IPs. A single attacker on a botnet can use thousands of addresses. Layered defense (ModSecurity, Imunify360, Cloudflare) catches the pattern instead.
  • It doesn’t auto-unblock. There’s no time limit. If you blocked your office’s IP by mistake, log in to cPanel from elsewhere and remove it.

​
Common issues

Log in to cPanel from a different network (4G hotspot, public Wi-Fi, a VPN to a different country). Remove the block. Or open a support ticket; we can lift it server-side.
Cloudflare proxy hides the visitor’s real IP, your origin sees Cloudflare’s edge IP instead. Either disable proxy on the domain, or block the visitor at Cloudflare’s WAF where the real IP is visible.
The IP Blocker is the wrong tool. Imunify360 catches and bans patterns automatically; ModSecurity rules can match on User-Agent or path. For an active attack, open a ticket.
cPanel writes the rule with Deny from <range> syntax that Apache understands. If the range is huge (a /8 or larger), Apache can be slow or refuse to parse it. Stick to /16 or smaller; for bigger blocks, use Cloudflare or a firewall rule.

​
Need a hand?

Open a ticket

Best for anything that needs an account check or a config change on our end.

Live chat

Faster for quick questions during business hours.