Using cPanel’s IP Blocker to Stop Bad Traffic – A Practical Guide

Why IP Blocker Matters

In shared hosting, one malicious IP can affect every site on a server. cPanel’s IP Blocker gives root/WHM admins a quick way to deny HTTP(S) requests from bad actors without touching each account. The feature writes firewall rules and a configuration file that survive reboots, so you don’t have to remember to re‑apply blocks after a server restart.

How the Feature Works Under the Hood

When you add an address in WHM → Security Center → IP Blocker, cPanel performs three actions:

• Appends the IP or CIDR block to /etc/cpanel/ips.conf.
• Generates an iptables rule (or a firewalld rule on systems using firewalld) that drops TCP packets destined for ports 80/443.
• Reloads the firewall so the rule takes effect immediately.

Because the rule is applied before Apache processes the request, a blocked client receives a 403 Forbidden or the connection is reset, depending on the underlying firewall.

Adding a Block – Step‑by‑Step Example

1. Log in to WHM as root.
2. Navigate to Security Center → IP Blocker.
3. Enter the offending IP, e.g., 203.0.113.42, and click Add.
4. Verify the entry appears in the list.

After the UI confirms the addition, run the following commands to check that the block is enforced:

# Show the iptables rule (Linux with iptables)
iptables -L INPUT -v -n | grep 203.0.113.42

# Or, for firewalld
firewall-cmd --list-all | grep 203.0.113.42

# Inspect the config file
cat /etc/cpanel/ips.conf | grep 203.0.113.42

If the rule is present, any HTTP(S) request from that IP will be denied. To test from the client side, run:

curl -I https://example.com

and you should see a 403 Forbidden status.

Trade‑offs and Limitations

• Scope of Blocking: IP Blocker only affects web traffic (ports 80/443). SSH, FTP, or mail services are untouched unless you add separate firewall rules.
• Shared IP Risk: In a typical shared hosting setup, many sites share the same public IP. Blocking that IP will deny all visitors, including legitimate users, so use it only when you’re certain the IP is malicious.
• Granularity: The feature cannot block specific URLs or user‑agents; it works at the IP level.
• Persistence: While the block survives reboots, removing it requires WHM or manual editing of /etc/cpanel/ips.conf.

Practical Checklist Before Adding a Block

1. Confirm the IP is truly malicious (e.g., repeated failed logins, known botnet address).
2. Check that the IP is not shared with legitimate users (e.g., by querying nslookup or using a public IP reputation service).
3. Add the block via WHM and run the verification commands above.
4. Monitor server logs for any unexpected 403 responses after a few hours.
5. Export the block list for audit: Security Center → IP Blocker → Export.

Closing Thoughts

cPanel’s IP Blocker is a quick, integrated tool for stopping bad HTTP traffic. Use it sparingly, verify its impact, and pair it with more granular controls (e.g., fail2ban, mod_security) for a layered defense. By following the steps above, you can add a block, confirm it’s active, and avoid the pitfalls of over‑blocking.