How do I block an IP address in cPanel?

October 15, 2026 · 3 min read · Markdown

If one visitor is hitting your site with login attempts, scraping pages or filling your forms with junk, you can turn them away at the server before the request reaches your website. cPanel's IP Blocker does this for the websites on your account. To follow along, log in to cPanel and look for the Security section on the home screen.

Blocking by IP works best as a short-term measure. Unwanted traffic often moves to new addresses within hours, so treat this as a way to buy quiet while you fix the underlying problem (a hardened login page, a form with a spam check, stronger passwords).

Find the address you want to block

1. From the cPanel home screen, open Visitors under Metrics.
2. Pick the domain you want to look at.
3. Scan the list for one address appearing over and over, especially on the same URL. The IP is shown in the left-hand column.
4. For a longer history, use Raw Access instead and download the full log for that domain.

Before you block anything, confirm the address is not your own. Searching "what is my IP" in your browser will show the address your connection uses. If you are troubleshooting a WordPress login problem, the record of failed attempts may also be in your security plugin's log rather than the server log.

Add the block

1. Go back to the cPanel home screen and open IP Blocker under Security.
2. Type the address into the "Add an IP or Range" box.
3. Select Add.
4. The entry now shows in the list of currently blocked addresses lower on the page.

The box accepts a few formats: a single address (203.0.113.45), a start and end range (203.0.113.1-203.0.113.50), or CIDR notation (203.0.113.0/24). Use a range only when you are sure about it, because a wide range can take in real visitors along with the one you meant to stop.

IP Blocker works by writing deny rules into the .htaccess file at your account's document root, so it covers your website over both HTTP and HTTPS. It does not filter mail, FTP or cPanel logins.

Remove a block

1. Open IP Blocker under Security.
2. Find the entry in the list of blocked addresses.
3. Select Delete, then confirm on the screen that follows.

If you blocked your own address by mistake, your website stops loading for you while cPanel keeps working normally, so you can still sign in and delete the entry.

If it didn't work

• Requests are still coming through. If your site sits behind a CDN or proxy, the server sees the proxy's address rather than the visitor's, so blocking the visitor's real IP changes nothing. Block the address your own logs show, or use the filtering built into whatever sits in front of your site.
• The site returns a 500 error after you add a block. Another rule in .htaccess may conflict with the new lines. Open File Manager, keep a copy of .htaccess, then remove the deny lines by hand and add them back one at a time.
• One site is protected and another is not. Addon domains have their own document root and their own .htaccess file, so a rule added for the main domain may not apply to them. Check each domain separately.

If the traffic keeps coming after that, open a ticket at /support with the IP address and the dates and times you saw it, and we can look at the server logs with you.

Stuck partway through? Support is answered by the engineers who run the servers, around the clock.

← All guides