Skip to main content
Submit a request

How to block or allow an IP address

Maxim Tsitsejev
Updated

Applies to: All plans.

Before you start: You will need access to cPanel (sign in via single sign-on from your service in the client area — see How to log in to cPanel), and the exact IP address or range you want to block. To find a visitor's IP, check your raw access logs, your site's analytics, or a security alert we have sent you.

cPanel's IP Blocker lets you stop specific IP addresses from reaching your site, and Hotlink Protection stops other websites from embedding (hot-linking) your images and using up your bandwidth. Here is how to use both.

Note: IP Blocker controls who can reach your hosting account. It does not affect malware scanning or the server firewall — those run automatically at server level (ModSecurity with the OWASP rule set, plus server-side malware scanning).

Block an IP address

  1. Log in to cPanel from your service page in the client area.
  2. Go to cPanel -> Security -> IP Blocker (also called IP Deny Manager).
  3. In the IP Address or Domain field, enter what you want to block. You can enter:
    • A single address, e.g. 192.0.2.10
    • A range, e.g. 192.0.2.1-192.0.2.50
    • A CIDR range, e.g. 192.0.2.0/24
  4. Click Add.

Result: The address now appears in the list of Currently-Blocked IP Addresses and can no longer load your website.

Allow (unblock) an IP address

To remove a block you added earlier:

  1. Go to cPanel -> Security -> IP Blocker.
  2. Find the entry in the Currently-Blocked IP Addresses list.
  3. Click Delete next to it and confirm.

Result: The address can reach your site again.

There is no separate "always allow" list in IP Blocker — anything you have not blocked is already allowed. If a legitimate visitor is being blocked by our security layer (not by your own IP Blocker rules), that is usually a ModSecurity false positive; our support team can whitelist it for you.

Turn on Hotlink Protection

Hotlink Protection stops other websites from displaying your images directly while serving the bandwidth bill to you.

  1. Go to cPanel -> Security -> Hotlink Protection.
  2. Check that the URLs to allow access box lists your own domain(s). cPanel usually adds these automatically.
  3. In Block direct access for the following extensions, list the file types to protect, e.g. jpg,jpeg,gif,png.
  4. Click Enable.

Result: Your images now load on your own pages but return blocked when another site tries to hot-link them.

To switch it off later, return to the same page and click Disable.

Troubleshooting this task

  • You blocked yourself by mistake. If you can no longer reach your own site, your current IP may be in the block list. Use a different network (such as mobile data) to log in to cPanel and delete the entry, or contact support.
  • A blocked visitor can still load the site. DNS or caching can serve a stored copy briefly. Allow a few minutes, and remember Maxinodes-managed DNS does not change who IP Blocker affects — the block applies at the hosting node.
  • You need to block a whole country or a large attack. IP Blocker is best for a handful of addresses. Common attack patterns are already caught at server level by ModSecurity (Managed plans also include DDoS mitigation); for a sustained attack or a suspected infection, contact support.
  • Hotlink Protection broke your own images or a trusted partner. Add the missing domain to the URLs to allow access list, then re-enable.

Related articles

Comments

0 comments

Please sign in to leave a comment.