Blocking IP Addresses

The IP Blocker in cPanel lets you deny access to your website from specific IP addresses or ranges. This is useful for blocking abusive visitors, bots, or known malicious IP addresses.

Please note: Screens and options may vary slightly depending on your cPanel version and hosting plan.

When You Would Use This

Use this to block abusive visitors, persistent bots, or known malicious IP addresses that are attacking your site or consuming excessive resources.

Blocking an IP Address

1. Log in to your cPanel account.
2. In the Security section, click IP Blocker.
3. In the Add an IP or Range field, enter one of the following:

- A single IP address (e.g. 203.0.113.50) - A range (e.g. 203.0.113.0-203.0.113.255) - A CIDR notation (e.g. 203.0.113.0/24) - An implied range (e.g. 203.0.113. blocks the entire 203.0.113.x range)

1. Click Add.

Blocked visitors will receive a 403 Forbidden error when trying to access your website.

Removing a Block

1. On the IP Blocker page, scroll to the list of currently blocked IPs.
2. Click Delete next to the entry you want to remove.

Finding Abusive IP Addresses

To identify IP addresses that may need blocking:

• Check your Raw Access Logs for unusual patterns (high request rates, repeated failed login attempts).
• Review Error Logs for suspicious 404 or 403 activity.
• Use visitor statistics tools like AWStats to identify high-volume visitors.
• If you use WordPress, security plugins often report blocked login attempts with IP addresses.

Tips

• Be careful not to block your own IP address — you'll lock yourself out of your website. If this happens, contact your hosting provider for assistance.
• IP blocking is a basic measure. Determined attackers can change IP addresses easily. For comprehensive protection, consider a Web Application Firewall (WAF) like ModSecurity or a CDN like Cloudflare.
• Blocking entire country ranges is possible but may affect legitimate visitors. Use this sparingly.
• IP blocks are implemented via .htaccess rules. You can also manage them manually in the .htaccess file.

What Next?

• Enabling Hotlink Protection — Prevent others from using your bandwidth.
• Understanding ModSecurity (WAF) — Server-level protection against common attacks.

Related Articles

• Enabling Hotlink Protection
• Understanding ModSecurity (WAF)
• Downloading Raw Access Logs