{"id":59,"date":"2026-05-03T11:32:46","date_gmt":"2026-05-03T18:32:46","guid":{"rendered":"https:\/\/cpanelreview.com\/index.php\/2026\/05\/03\/block-ip-addresses-cpanel-ip-blocker-csf-cphulk\/"},"modified":"2026-05-03T11:32:46","modified_gmt":"2026-05-03T18:32:46","slug":"block-ip-addresses-cpanel-ip-blocker-csf-cphulk","status":"publish","type":"post","link":"https:\/\/cpanelreview.com\/index.php\/2026\/05\/03\/block-ip-addresses-cpanel-ip-blocker-csf-cphulk\/","title":{"rendered":"How to Block IP Addresses in cPanel: IP Blocker, CSF, and cPHulk Guide"},"content":{"rendered":"

Why IP Blocking Matters for Your cPanel Server<\/h2>\n

Every day, automated bots, brute-force attackers, and malicious scanners probe cPanel servers looking for vulnerabilities. Without proper IP blocking, your site wastes resources handling unwanted traffic and risks unauthorized access. cPanel provides built-in tools to block specific IP addresses or entire ranges at the server level \u2014 stopping threats before they ever reach your applications.<\/p>\n

Whether you’re dealing with a single persistent attacker or a distributed botnet, cPanel’s IP Blocker and firewall integration give you granular control over who can connect to your server. This guide walks through the practical methods for blocking IPs in cPanel, from the easy point-and-click interface to command-line firewall rules for power users.<\/p>\n

<\/p>\n

Using the cPanel IP Blocker Interface<\/h2>\n

The simplest way to block an IP address is through the IP Blocker<\/strong> tool in cPanel. This feature adds rules to your server’s firewall (typically CSF or iptables) behind the scenes, so you don’t need to touch the command line.<\/p>\n

Accessing IP Blocker<\/h3>\n
    \n
  1. Log into your cPanel dashboard<\/li>\n
  2. Navigate to the Security<\/strong> section<\/li>\n
  3. Click IP Blocker<\/strong><\/li>\n
  4. You’ll see a list of currently blocked addresses and a form to add new ones<\/li>\n<\/ol>\n

    Adding an IP or Range<\/h3>\n

    In the Add an IP or IP Range<\/strong> field, you can enter:<\/p>\n

      \n
    • A single IP:<\/strong> 192.168.1.100<\/code><\/li>\n
    • A CIDR range:<\/strong> 192.168.1.0\/24<\/code> (blocks 192.168.1.0 through 192.168.1.255)<\/li>\n
    • A wildcard range:<\/strong> 192.168.1.*<\/code> (equivalent to the \/24 range above)<\/li>\n
    • A partial IP:<\/strong> 192.168.<\/code> (blocks everything starting with 192.168)<\/li>\n<\/ul>\n

      After entering the address, click Add<\/strong>. The block takes effect immediately. You’ll see the new rule appear in the list below with a timestamp. To remove a block later, click the Delete<\/strong> link next to the IP entry.<\/p>\n

      \n

      Note:<\/strong> Be careful with broad ranges. Blocking a large ISP range like 10.0.0.0\/8<\/code> could lock out legitimate visitors. Always verify the IPs you’re blocking belong to known attackers.<\/p>\n<\/div>\n

      Blocking IPs Through cPanel’s ModSecurity Integration<\/h2>\n

      cPanel also integrates with ModSecurity<\/strong>, a web application firewall that can block IPs based on attack patterns. When combined with the cPanel ModSecurity Rule Editor<\/strong>, you can create custom rules that block specific IPs from accessing your web applications while still allowing other services like email or FTP.<\/p>\n

      To create a ModSecurity IP block:<\/p>\n

        \n
      1. Go to ModSecurity<\/strong> in the Security section of cPanel<\/li>\n
      2. Select the domain you want to protect<\/li>\n
      3. Click Add a Custom Rule<\/strong><\/li>\n
      4. Paste a rule like:<\/li>\n<\/ol>\n
        SecRule REMOTE_ADDR \"^192\\.168\\.1\\.100$\" \\\n    \"id:100001,phase:1,deny,status:403,msg:'Blocked malicious IP'\"<\/code><\/pre>\n
        This blocks the specified IP at the web application layer, returning a 403 Forbidden response. The advantage over the IP Blocker is that ModSecurity rules can be more specific \u2014 for example, blocking an IP only for certain URLs or during certain hours.<\/p>\n
        Using CSF (ConfigServer Security & Firewall) with cPanel<\/h2>\n
        Most cPanel servers include CSF<\/strong> (ConfigServer Security & Firewall), a powerful firewall management system. CSF gives you more advanced IP blocking capabilities than the basic IP Blocker tool.<\/p>\n
        Blocking an IP in CSF<\/h3>\n
        If you have root access or WHM reseller permissions, you can manage CSF directly:<\/p>\n
          \n
        1. Log into WHM<\/strong> or SSH into your server<\/li>\n
        2. Run: csf -d 192.168.1.100<\/code> \u2014 this denies (blocks) the IP<\/li>\n
        3. To confirm the block: csf -g 192.168.1.100<\/code><\/li>\n
        4. To remove: csf -dr 192.168.1.100<\/code><\/li>\n<\/ol>\n
          Temporary Blocks with CSF<\/h3>\n
          CSF also supports time-limited blocks via its temporary deny feature:<\/p>\n
          csf -td 192.168.1.100 3600<\/code><\/pre>\n
          The third argument is the duration in seconds. The example above blocks the IP for one hour (3600 seconds). After expiration, the IP is automatically removed from the deny list.<\/p>\n
          Managing CSF Through WHM<\/h3>\n
          For users who prefer a GUI:<\/p>\n
            \n
          1. Log into WHM<\/strong><\/li>\n
          2. Search for ConfigServer Security & Firewall<\/strong><\/li>\n
          3. Click Firewall Deny IPs<\/strong> under the Quick Actions section<\/li>\n
          4. Paste IPs (one per line) and click Add<\/strong><\/li>\n<\/ol>\n
            CSF uses \/etc\/csf\/csf.deny<\/code> as its persistent deny list. You can edit this file directly to add multiple IPs at once, which is useful when importing a blocklist of known bad actors.<\/p>\n
            Identifying Which IPs to Block<\/h2>\n
            Knowing which<\/em> IPs to block is half the battle. cPanel provides several tools to help identify problematic addresses:<\/p>\n
            Check Apache Access Logs<\/h3>\n
            In cPanel’s Metrics<\/strong> section, open Awstats<\/strong> or Analog Stats<\/strong> to spot patterns. Look for:<\/p>\n