How to blacklist an IP Address to deny it access to your website?

Block an IP in cPanel by using Security > IP Blocker, or on a VPS by adding a firewall or web server rule. Remove the block in the same place you added it.

Before you start

• Have the exact IP or range to block. A broad pattern like 10. blocks an entire /8 range.
• If your site is behind Cloudflare or another reverse proxy, the server may see the proxy IP instead of the visitor until you restore the real IPs.
• For VPS changes you need root or Administrator access. Keep console access ready so you can undo a mistake.

Step 1: Block an IP in cPanel IP Blocker

1. Log in to cPanel, open Security then IP Blocker.
2. Enter the IP or range. Accepted formats include:
   • Single IP: 203.0.113.10
   • Range: 203.0.113.10-203.0.113.40 or implied range 203.0.113.10-40
   • CIDR: 203.0.113.0/24
   • Warning: entering 10. blocks 10.*.*.*.
3. Click Add. The entry appears under Currently-Blocked IP Addresses.
4. Undo: In the same screen, find the entry in Currently-Blocked IP Addresses, click Delete, then confirm Remove IP.

Note: IP Blocker only restricts access to your website, not other services such as Webmail.

Step 2: Block an IP at the server firewall on a VPS

AlmaLinux with firewalld

This rejects the source IP for web ports only. It persists across reboot.

# Block HTTP
sudo firewall-cmd --permanent --add-rich-rule 'rule family="ipv4" source address="203.0.113.10" port port="80" protocol="tcp" reject'
# Block HTTPS
sudo firewall-cmd --permanent --add-rich-rule 'rule family="ipv4" source address="203.0.113.10" port port="443" protocol="tcp" reject'
# Apply changes
sudo firewall-cmd --reload

Undo:

sudo firewall-cmd --permanent --remove-rich-rule 'rule family="ipv4" source address="203.0.113.10" port port="80" protocol="tcp" reject'
sudo firewall-cmd --permanent --remove-rich-rule 'rule family="ipv4" source address="203.0.113.10" port port="443" protocol="tcp" reject'
sudo firewall-cmd --reload

Ubuntu or Debian with UFW

This denies the source IP to HTTP and HTTPS.

sudo ufw deny proto tcp from 203.0.113.10 to any port 80,443

Undo:

sudo ufw delete deny proto tcp from 203.0.113.10 to any port 80,443

If you also want IPv6 filtering, set IPV6=yes in /etc/default/ufw and reload UFW.

Step 3: Block an IP in the web server on a VPS

Apache 2.4

Use modern syntax. Test the config before you reload, to avoid a 500 error. Testing does not apply the rule: the reload does.

# Inside the relevant <Directory>, <Location> or vhost context
<RequireAll>
    Require all granted
    Require not ip 203.0.113.10
</RequireAll>

# Validate syntax
sudo apachectl configtest   # expects "Syntax OK"

# Apply the rule
sudo apachectl graceful

An IPv4 rule only covers IPv4. If the same client can also reach you over IPv6, add a second Require not ip line with the IPv6 address, then test and reload again.

Undo: remove those lines, run sudo apachectl configtest, then run sudo apachectl graceful.

NGINX

Add within the server or location block. Test the config first, then reload to apply it.

deny 203.0.113.10;

# Validate syntax
sudo nginx -t

# Apply the rule
sudo nginx -s reload

As with Apache, an IPv4 deny does nothing about IPv6. If the client also connects over IPv6, add a second deny line for the IPv6 address, then test and reload again.

Undo: remove the deny line or lines, run sudo nginx -t, then run sudo nginx -s reload.

Windows Server IIS

In IIS Manager, select the site, open IP Address and Domain Restrictions, choose Add Deny Entry…, enter the IP or range. Settings applied at site level take precedence over server level settings, so a server wide allow will not override a deny set on the site. Undo: return to the same IP Address and Domain Restrictions screen for that site and delete the deny entry you added.

If it does not work

• Site is behind Cloudflare or another proxy. Your server sees the proxy IP by default, so your rules miss the real client. Configure Apache's mod_remoteip or the equivalent so the server uses the original visitor IP. Blocking a Cloudflare edge IP blocks many visitors.
• The rule appears to do nothing. Check you reloaded the web server after editing the config. A passing configtest or nginx -t only checks syntax.
• 500 errors after editing .htaccess or Apache. Revert your last change. Use Apache 2.4 syntax, not the old Order/Allow/Deny directives. Validate with apachectl configtest before reload. If you lock out SSH, use the Virtualizor VNC console from the Hostworld client area to recover.
• Blocks only affect the website. That is expected with cPanel IP Blocker. To restrict other services, add rules at the VPS firewall. If you need us to review, open a support ticket.

What next

If you run a VPS and want more control, see our VPS guides for firewall and web server configuration patterns. If you need to change VPS capacity for traffic spikes, see our Linux VPS options. If in doubt, open a support ticket and we will check what you have added.