How to Block or Allow IP Addresses for Your Website Print

You can stop particular IP addresses reaching your website, for example a persistent spammer or scraper. You can also do the opposite and lock an area such as your admin login so that only your own IP can open it. This article covers both, using cPanel's IP Blocker and .htaccess rules.

Block an IP with IP Blocker

1. Log in to cPanel and open Security › IP Blocker.
2. Under Add an IP or Range, enter the address or range to block. For example:
   • a single address: 203.0.113.45
   • a range: 203.0.113.10-203.0.113.40
   • CIDR notation: 203.0.113.0/24
3. Click Add.

Blocked addresses are listed under Currently-Blocked IP Addresses. To unblock one, click Delete next to it.

Block an IP with .htaccess

Add this to the .htaccess file in public_html (see editing .htaccess in cPanel), replacing the addresses with the ones you want to block:

<RequireAll>
Require all granted
Require not ip 203.0.113.45
Require not ip 198.51.100.0/24
</RequireAll>

Older guides use Order allow,deny and Deny from lines. That's outdated Apache 2.2 syntax, so use the Require rules above instead.

Only allow your own IP into an admin area

1. Find your IP address with our What's my IP tool.
2. Create or edit a .htaccess file inside the folder you want to protect, for example public_html/wp-admin/.htaccess for WordPress.
3. Add one Require ip line for each address that should have access:
   Require ip 203.0.113.45
Require ip 198.51.100.7
4. Save, then test from another connection, such as mobile data. There, you should get a 403 Forbidden error.

Good to know

• Most home and mobile IPs change. When yours changes, an allow-only rule locks you out too, and you'll need to update the file in cPanel's File Manager. Allow-only rules work best with a fixed office IP.
• In WordPress, the public site uses wp-admin/admin-ajax.php. If parts of your site stop working after you restrict wp-admin, allow that file separately or use a password-protected directory instead.
• These rules only affect your website. If you can't reach the site, email or cPanel, the server firewall may have blocked you. See how to get your IP unblocked.