How to Tell if Your IP Address Is Blocked by the Server and Why

Our servers use three security systems to protect your hosting account (these are on the server, not on your devices):

• CSF/LFD (ConfigServer Firewall & Login Failure Daemon) — network‑level firewall that blocks IPs for suspicious activity
• cPHulk Brute Force Protection — login‑level protection that blocks IPs or accounts after repeated failed logins
• ModSecurity Web Application Firewall (WAF) — protects websites by blocking suspicious or malicious HTTP requests

If you suddenly cannot access your website, cPanel, WHM, Webmail, FTP/SFTP, or email, your IP address may be blocked by one of these systems.

This trouble shooting guide explains the symptoms, error messages, and codes that indicate your IP is blocked — and how to confirm it. Once confirmed, provide the info you identified and provide it to us. Include your IP address that you can find at WhatIsMyIP.

1. Common Symptoms of an IP Block

If your IP is blocked by CSF/LFD, cPHulk, or ModSecurity, you may experience:

• Website does not load (timeout or reset)
• Website loads but certain pages return errors
• cPanel/Webmail login pages fail to load
• FTP/SFTP connection fails immediately
• Email clients cannot connect to IMAP/POP/SMTP
• Services work from mobile data or another network, but not from your home/office

If the service works anywhere except your current network, your IP is almost certainly blocked.

2. Browser Errors That Suggest a Firewall Block (CSF/LFD)

When CSF blocks your IP, your browser may show:

• ERR_CONNECTION_TIMED_OUT
• ERR_CONNECTION_RESET
• This site can’t be reached
• The connection was reset
• The connection has timed out

These occur because CSF drops packets silently.

3. Login Errors That Suggest a cPHulk Block

cPHulk blocks login attempts but does not block website access.
If you can load the login page but cannot authenticate, cPHulk may be the cause.

Common cPHulk indicators:

• “The login is invalid.” (even with correct credentials)
• “The system has detected too many login attempts.”
• “Your IP address has been temporarily blocked due to failed login attempts.”
• “The system has locked your account due to excessive authentication failures.”

If the login page loads but authentication fails instantly, cPHulk is likely blocking you.

4. FTP/SFTP Error Codes That Indicate a Firewall Block

FTP/SFTP clients may show:

• ECONNREFUSED
• ETIMEDOUT
• Connection timed out
• Server sent passive reply with unroutable address

If your credentials are correct but the connection fails immediately, CSF/LFD is likely blocking your IP.

5. Email Client Errors Caused by Firewall Blocks

Email apps (Outlook, Apple Mail, Thunderbird) may show:

• 0x800CCC0E – Cannot connect to server
• 0x800CCC0F – Connection dropped
• “Cannot connect to IMAP/POP server”
• “Connection timed out”
• “Server unexpectedly closed connection”

These occur when CSF blocks IMAP/POP/SMTP ports.

If you recently changed your email password and a device still uses the old one, repeated failures can trigger both CSF and cPHulk.

6. Why Your IP Might Be Blocked (CSF/LFD, cPHulk, or ModSecurity)

CSF/LFD may block your IP for:

• Too many failed cPanel/Webmail logins
• Too many failed FTP/SFTP logins
• Email client repeatedly using the wrong password
• Port scanning or rapid connection attempts
• Excessive IMAP/POP connections
• Country or ASN restrictions (if enabled)

cPHulk may block your IP for:

• Repeated failed logins to:
  • cPanel
  • Webmail
  • SFTP/FTP (if using system authentication)
• Logging in too quickly or too frequently
• Using outdated saved passwords on devices

ModSecurity may block your IP for:

• Submitting forms too quickly or too frequently
• Triggering false positives in security rules
• Using certain characters in URLs or form fields (e.g., <>, {}, SQL‑like strings)
• Uploading files that match security signatures
• Automated tools, scanners, or bots hitting your site

ModSecurity blocks often show a 403 Forbidden error, even when the rest of the site loads normally.

7. How to Confirm if Your IP Is Blocked

Step 1 — Check your public IP

Visit:
WhatIsMyIP

Copy the IP address shown.

Step 2 — Test from another network

Try:

• Mobile phone on LTE/5G
• VPN
• Neighbor’s Wi‑Fi

If everything works elsewhere, your IP is blocked.

Step 3 — Contact Support

Provide:

• Your public IP
• The service you cannot access
• Any error messages you received

We will check CSF/LFD, cPHulk, and ModSecurity logs and unblock your IP if needed.

8. How to Prevent Future Blocks

To avoid triggering CSF/LFD, cPHulk, or ModSecurity:

• Ensure all devices use the correct email password
• Remove old email accounts from phones/tablets
• Avoid repeated login attempts
• Use secure, updated passwords
• Do not run automated scanners or crawlers
• Avoid aggressive FTP/SFTP retry settings
• When submitting forms, avoid special characters unless required
• If you use a CMS (WordPress, Joomla, etc.), keep plugins and themes updated

If you have a static IP, we can whitelist it upon request.

Need Help?

If you believe your IP is blocked, contact our support team with your public IP address. We’ll review the firewall logs and restore access quickly.