Control Panels

cPanel IP Blocker (IP Deny Manager): How to Block IP Addresses From Your Website

The IP Deny Manager in cPanel allows you to block specific IP addresses, domains, or entire IP ranges from accessing your website. This feature is useful for preventing malicious visitors, spam attacks, and unauthorized access.

Short answer: In cPanel, open Security > IP Blocker (called IP Deny Manager in older versions), enter an IP address, a range or a domain name, and click Add. Visitors from that address then get a 403 Forbidden error on your websites. The block applies only to web traffic on your account. It does not stop email or FTP, and it needs extra setup if your site is behind Cloudflare.

What IP Blocker does

IP Blocker adds deny rules to the .htaccess file in your public_html folder. The web server then refuses requests from the blocked addresses. It is useful for:

  • Stopping a bot or scraper that hammers your site.
  • Blocking an address that keeps trying to log in to your CMS.
  • Keeping out a visitor who spams your forms or comments.

Because the rules live in .htaccess, they apply to the sites under public_html, including addon domains in subfolders of it.

Block an IP address

  1. Log in to cPanel.
  2. Open Security > IP Blocker.
  3. Enter the address, range or domain in the Add an IP or Range field.
  4. Click Add. The entry appears in the list of blocked addresses.

Formats you can use

Format Example Blocks
Single IP address 203.0.113.25 One IPv4 address
Range 203.0.113.10-203.0.113.40 Every address between the two
CIDR 203.0.113.0/24 A whole network (256 addresses here)
Partial address 203.0.113. Every address that starts with these numbers
IPv6 2001:db8::25 One IPv6 address
Domain name example.net The IP address the domain points to at the time you add it

Be careful with ranges. A large range can block real visitors who share a provider with the attacker.

Remove a block

  1. Open Security > IP Blocker.
  2. Find the address in the list of currently blocked IP addresses.
  3. Click Delete next to it and confirm.

Find which addresses to block

Before you block, check who is causing the problem. In cPanel, Metrics > Visitors and Metrics > Raw Access show recent requests with their IP addresses. Look for one address with a very high number of requests, or many requests to login pages such as wp-login.php or xmlrpc.php.

What the rules look like

IP Blocker writes rules like these to public_html/.htaccess. You can also add them by hand:

<RequireAll>
    Require all granted
    Require not ip 203.0.113.25
    Require not ip 198.51.100.0/24
</RequireAll>

Keep a copy of .htaccess before you edit it by hand. A typing mistake causes a 500 error for the whole site.

Sites behind Cloudflare

If your site uses Cloudflare’s proxy, every request reaches the server from a Cloudflare IP address, so blocking a visitor’s address in cPanel has no effect. Block the address in Cloudflare’s security rules instead, or ask your host to set up real visitor IPs. Our Cloudflare and cPanel guide explains how.

Limits of IP blocking

  • Attackers can change IP addresses, so blocks on single addresses rarely stop a determined attacker.
  • IP Blocker does not protect email, FTP or cPanel logins. The server firewall and cPHulk handle those.
  • Blocking a domain blocks only the IP address it had when you added it. If the domain moves, update the block.

For server-wide protection on a VPS or dedicated server, use a firewall such as CSF, and a web application firewall such as ModSecurity.

Troubleshooting

Problem Likely cause Fix
The blocked visitor still gets through The site is behind Cloudflare or another proxy Block the address in Cloudflare, or set up real visitor IPs.
You blocked yourself Your own address or range was added Remove it in IP Blocker from another network, or ask support.
The site shows a 500 error after a manual edit A mistake in .htaccess Restore the copy of .htaccess or fix the line.

Need help with this?

Under attack or getting too many bad requests? Our support team can help block the source.

See web hosting plansContact @CustomerPanel

Frequently asked questions

Where is IP Deny Manager in the new cPanel?

It is called IP Blocker, under Security.

Does IP Blocker block email from an address?

No. It blocks web access only. Use email filters or the server firewall for mail.

Can I block a whole country in cPanel?

Not with IP Blocker in a practical way. Use Cloudflare’s country rules, or a server firewall such as CSF on a VPS.

Why does a blocked visitor still reach my site?

Usually because the site is behind Cloudflare, so the server sees Cloudflare’s IP addresses. Block the visitor in Cloudflare.

How do I unblock an IP address?

Open Security > IP Blocker, find the address in the list, and click Delete.


Sources