cPanel Security

Stop a Visitor for Good: How to Block an IP Address in cPanel

Ban a single troublemaker, an entire range, or a CIDR block from your site in under a minute, straight from cPanel — no code, no plugin.

cPanel

Built-in tool

CIDR

Range support

Instant

Takes effect

24/7

Human support

In short

To block an IP address in cPanel, log in and open IP Blocker under the Security section. Type the IP address, a range (e.g. 203.0.113.1-203.0.113.50), or a CIDR block (e.g. 203.0.113.0/24) into the field, click Add, and cPanel denies matching requests at the server level immediately — no file editing or restart required.

If you only need to block one folder or don't have cPanel access, add a Deny directive to .htaccess instead — it works per-directory and takes effect the moment the file saves.

Repeated failed logins on wp-login.php, a scraper hammering your product pages, or a single IP flooding your contact form with spam are common reasons to reach for cPanel's IP Blocker. Rather than filtering these visitors in application code, you deny them before they ever reach PHP, your database, or WordPress itself.

IP Blocker lives in every standard cPanel account under the Security section, so you don't need SSH or root access to use it. On NVMe and LiteSpeed-backed hosting, blocking at this level matters even more, because a denied request never spins up a PHP process or hits the database — it's dropped by the web server, keeping resources free for legitimate traffic.

Where to Find IP Blocker in cPanel

Log in to cPanel and look under the Security section on the main dashboard (or use the search bar and type "IP Blocker"). The tool opens to a simple form: a text field for the address or range you want to deny, an Add button, and a list below showing every IP you've already blocked.

Because IP Blocker is built into cPanel itself rather than a plugin, it works the same way regardless of what CMS or framework your site runs — WordPress, a custom PHP app, or a static site all get the same server-level protection.

Blocking a Single IP, a Range, or a CIDR Block

For one troublesome visitor, paste the single IP address (e.g. 198.51.100.23) and click Add — it's denied immediately. For a run of addresses coming from the same subnet, use a hyphenated range like 198.51.100.1-198.51.100.30, or a CIDR block such as 198.51.100.0/24 to cover an entire block in one entry.

CIDR notation is the more efficient option when an attack is clearly coming from one hosting provider or data center range rather than a single home connection — one rule replaces dozens of individual entries and is easier to review later.

When to Use .htaccess Deny Instead

If you need the block to apply to only one folder — say, an admin area or a staging subdirectory — rather than the whole account, adding a deny rule directly to that folder's .htaccess file is more precise than a blanket IP Blocker entry that covers every domain on the account.

It's also the fallback when you're on a reseller sub-account or shared environment without direct access to IP Blocker: .htaccess rules take effect as soon as the file saves, with no panel access needed at all.

Common Mistakes That Lock Out the Wrong Visitors

The most frequent error is blocking a shared or dynamic IP — home broadband and mobile carriers frequently reassign addresses, so today's attacker's IP can belong to a genuine customer next week. Review your blocklist periodically instead of leaving entries in place indefinitely.

A second mistake is blocking an entire CIDR range too aggressively, which can catch legitimate visitors sharing that subnet with an attacker. When in doubt, block the single IP first and only widen to a range if the abuse clearly continues from nearby addresses.

Server-Level Blocking Beats Application-Level Filtering

Blocking at cPanel's server layer stops a bad request before it costs you anything — no PHP process spins up, no database query runs, and no WordPress hook fires. That matters most during an active brute-force attempt or scraping run, when hundreds of requests per minute can otherwise chew through server resources meant for real visitors.

On pure NVMe SSD storage with LiteSpeed, denied requests are dropped almost instantly, so a blocklist with dozens of entries adds no meaningful overhead. Combined with daily backups and free auto-renewing SSL, IP Blocker is one more layer that keeps a site both fast and defensible without extra software.

Denies traffic before PHP or the database ever run
Works identically across WordPress, custom apps, and static sites
Supports single IPs, hyphenated ranges, and CIDR blocks
Sits alongside daily backups and free SSL as baseline protection

Why Hosting Cheap

What you get

No code required

Add or remove blocked IPs from a simple form — no editing config files by hand.

Instant effect

Denials apply the moment you click Add, with no server restart needed.

Range and CIDR support

Cover an entire subnet in one entry instead of adding dozens of single IPs.

Works for any site type

Protects WordPress, custom PHP apps, and static sites the same way.

Server-level efficiency

Blocked requests never reach PHP or your database, saving resources for real visitors.

Reversible anytime

Remove an entry instantly if a legitimate visitor gets caught by mistake.

How It Works

Get set up in a few steps

Open IP Blocker

Enter the address or range

Type a single IP, a hyphenated range, or a CIDR block into the field.

Click Add and verify

Confirm the entry appears in your blocklist, then test that the address is denied.

Included

Everything you need, on every plan

Confirm the IP is actually causing abuse before blocking it
Use CIDR notation for attacks spanning a known subnet
Avoid blanket-blocking large ranges that may include real visitors
Review your IP Blocker list every few months and remove stale entries
Use .htaccess Deny rules for folder-specific restrictions instead
Pair IP blocking with strong passwords and two-factor login where available
Keep a note of why each IP was blocked for future reference
Check server logs first to identify the real offending address, not just a proxy

FAQ

Frequently asked questions

Does blocking an IP in cPanel affect the whole account or just one site?

IP Blocker applies at the account level, so it affects every domain hosted under that cPanel account. If you only want to restrict one site or folder, use a .htaccess Deny rule scoped to that specific directory instead.

Can I block a range of IP addresses instead of one at a time?

Yes. IP Blocker accepts hyphenated ranges like 203.0.113.1-203.0.113.50 as well as CIDR notation such as 203.0.113.0/24, so you can cover an entire subnet with a single entry rather than adding addresses one by one.

Will blocking an IP address slow down my site?

No. Denials happen at the server level before a request reaches PHP or the database, so a blocklist with a reasonable number of entries adds no noticeable overhead, especially on NVMe SSD and LiteSpeed hosting.

What's the difference between IP Blocker and a firewall?

IP Blocker denies specific addresses you choose manually, while a firewall inspects traffic patterns and can block automatically based on rules or behavior. Many sites use both — IP Blocker for known offenders and a firewall for broader, automated protection.

How do I unblock an IP address I added by mistake?

Open IP Blocker in cPanel, find the entry in your list, and remove it — the change takes effect immediately, restoring access for that address without any downtime.

Is blocking IPv6 addresses supported too?

Yes, cPanel's IP Blocker accepts IPv6 addresses and ranges in addition to IPv4, so you can deny traffic regardless of which protocol the visitor is connecting over.

Get cPanel Hosting With Security Tools Built In

IP Blocker, free auto-renewing SSL, and daily backups come standard — move in with free managed migration.

Get Started