Applies to: All plans.
Before you start: You will need access to cPanel (sign in via single sign-on from your service in the client area — see How to log in to cPanel), and the exact IP address or range you want to block. To find a visitor's IP, check your raw access logs, your site's analytics, or a security alert we have sent you.
cPanel's IP Blocker lets you stop specific IP addresses from reaching your site, and Hotlink Protection stops other websites from embedding (hot-linking) your images and using up your bandwidth. Here is how to use both.
Note: IP Blocker controls who can reach your hosting account. It does not affect malware scanning or the server firewall — those run automatically at server level (ModSecurity with the OWASP rule set, plus server-side malware scanning).
Block an IP address
- Log in to cPanel from your service page in the client area.
- Go to cPanel -> Security -> IP Blocker (also called IP Deny Manager).
- In the IP Address or Domain field, enter what you want to block. You can enter:
- A single address, e.g.
192.0.2.10 - A range, e.g.
192.0.2.1-192.0.2.50 - A CIDR range, e.g.
192.0.2.0/24
- A single address, e.g.
- Click Add.
Result: The address now appears in the list of Currently-Blocked IP Addresses and can no longer load your website.
Allow (unblock) an IP address
To remove a block you added earlier:
- Go to cPanel -> Security -> IP Blocker.
- Find the entry in the Currently-Blocked IP Addresses list.
- Click Delete next to it and confirm.
Result: The address can reach your site again.
There is no separate "always allow" list in IP Blocker — anything you have not blocked is already allowed. If a legitimate visitor is being blocked by our security layer (not by your own IP Blocker rules), that is usually a ModSecurity false positive; our support team can whitelist it for you.
IP Blocker affects your website only, not email. Two server-level blocks can stop mail from an address:
- The firewall graylist. An address that trips the web application firewall can be graylisted, which blocks every service from it, mail apps included, until someone on that network opens your site or webmail in a browser and passes the captcha.
- The mail login lock. 10 failed logins to a mailbox within 5 minutes lock it for 5 minutes, usually because a phone or laptop keeps trying an old password.
Neither can be cleared in IP Blocker; see My mail app can't connect, or keeps asking for my password.
Turn on Hotlink Protection
Hotlink Protection stops other websites from displaying your images directly while serving the bandwidth bill to you.
- Go to cPanel -> Security -> Hotlink Protection.
- Check that the URLs to allow access box lists your own domain(s). cPanel usually adds these automatically.
- In Block direct access for the following extensions, list the file types to protect, e.g.
jpg,jpeg,gif,png. - Click Enable.
Result: Your images now load on your own pages but return blocked when another site tries to hot-link them.
To switch it off later, return to the same page and click Disable.
Troubleshooting this task
- You blocked yourself by mistake. If you can no longer reach your own site, your current IP may be in the block list. Use a different network (such as mobile data) to log in to cPanel and delete the entry, or contact support.
- A blocked visitor can still load the site. DNS or caching can serve a stored copy briefly. Allow a few minutes, and remember Maxinodes-managed DNS does not change who IP Blocker affects — the block applies at the hosting node.
- You need to block a whole country or a large attack. IP Blocker is best for a handful of addresses. Common attack patterns are already caught at server level by ModSecurity (Managed plans also include DDoS mitigation); for a sustained attack or a suspected infection, contact support.
- Hotlink Protection broke your own images or a trusted partner. Add the missing domain to the URLs to allow access list, then re-enable.
Comments
0 comments
Please sign in to leave a comment.