Which layer blocked you: cPanel, CSF, or fail2ban
A blocked IP is held by one of three layers: cPanel's IP Blocker for the account, CSF and LFD on the server, or a fail2ban jail for one service. The error page names the layer. Clear that entry only, then reload the same URL from the same connection.
Editing the wrong layer wastes an hour because each one has its own list. Match the symptom first.
| What you see | Layer holding the block | Open this first |
|---|---|---|
| 403 page, or a cPanel login that says the IP is blocked | cPanel IP Blocker | Security, then IP Blocker |
| The site times out while ping still answers | CSF or LFD dropping packets | csf -g YOUR.IP |
| SSH or FTP rejects a password you know is right | fail2ban jail | fail2ban-client status |
| Only wp-admin or a form is refused | ModSecurity or a plugin firewall | The ModSecurity audit log |
| Only mail fails, the website loads | Mail jail, or the ISP blocking port 25 | The exim log and ports 465/587 |
A 403 is a refusal, not a crash. If the page instead returns a 500, the fault is in a file or a PHP limit, and the 500 error guide is the right page. The block here is deliberate, so there is a log line behind it.
Find the IP address your server sees
Run curl -4 ifconfig.me in a terminal to print the IPv4 address the internet sees. Add -6 to check whether IPv6 is in play, because a server can block one family while the other still works.
Then test whether the request reaches the server: curl -sS -o /dev/null -w "%{http_code}\n" https://example.com. A number such as 200 or 403 means something answered. A timeout or a reset means a network firewall dropped the packet before the web server saw it, which points at CSF or the host rather than WordPress.
Behind an office router every desk shares one public address, so a colleague's failed logins block the whole office. On mobile data the address changes when the phone reconnects, which is why a block can appear to clear itself on a phone and not on the desktop.
Unblock the IP in cPanel IP Blocker
Log in to cPanel hosting, open Security, then IP Blocker. The Currently Blocked IP Addresses list holds every entry added in this account. Select your address and click Delete, then reload the site. Older themes label the same tool IP Deny Manager.
If the list is empty, the block is not in your account. On shared hosting the server firewall belongs to the host; on a VPS you own, it is yours to edit with CSF. Deleting an entry that is not there changes nothing, which is why the empty list is useful information.
A saved password in a mail client or FTP app will re-add the entry within minutes. Clear the stored credential before you delete the block, or you will be back in this screen before the day ends.
Unblock with CSF and LFD on a VPS
CSF and LFD run on a VPS or dedicated server and need root SSH access. Each command changes one list, and the reload applies it.
csf -g 203.0.113.10shows every list that mentions the address: csf.deny, csf.allow, or a temporary deny.csf -dr 203.0.113.10removes a permanent deny, thencsf -rreloads the rules.csf -tr 203.0.113.10removes a temporary LFD deny without touching the permanent list.csf -a 203.0.113.10adds the address to csf.allow, for a static IP you control.
Change the address in every command. The -dr and -tr flags edit the file; without csf -r the running rules keep dropping the packet until the next restart. You know it worked when csf -g prints neither a deny nor a temporary deny for that address.
Unblock a fail2ban jail
fail2ban watches one service per jail, so an SSH block and a mail block are different jails with different lists. Unbanning sshd does nothing for a postfix block.
fail2ban-client statuslists the jails that are running.fail2ban-client status sshdshows the addresses currently banned in that jail.fail2ban-client set sshd unbanip 203.0.113.10removes the address from that jail.fail2ban-client set recidive unbanip 203.0.113.10clears the repeat-offender jail, which re-bans an address for much longer.
Use the jail name exactly as the status output prints it. A wrong name returns a message that the jail does not exist and changes nothing. If the jail list is empty, fail2ban is not the layer that blocked you.
Read the log line before you unblock again
A block that returns within the hour is a loop, not bad luck. Something keeps retrying the same failed login, so read the trigger before you clear the entry a second time.
/var/log/lfd.logrecords each CSF deny with the rule and the port./var/log/fail2ban.lognames the jail, the filter, and the line that matched.~/access-logs/example.comis the account's web log in cPanel, useful for the 404s and POSTs that tripped ModSecurity./usr/local/holds the rule ID and the request that matched, on a WHM server.apache/logs/ modsec_audit. log /var/log/exim_mainlogrecords SMTP authentication failures, which is what a mail jail reacts to.
Start with grep '203.0.113.10' /var/log/lfd.log | tail -5. The last field names the rule: LF_SSHD for an SSH password failure, LF_SMTPAUTH for a mail password, LF_MODSEC for a web request. Unblocking without that line guarantees a repeat.
Email blocks are not the same as web blocks
Mail fails like a wrong password even when the password is right, because the firewall can drop the port before the mail server sees the login. Check the port before you reset anything.
- Use port 465 with SSL or 587 with STARTTLS. Many Indian ISPs block outbound port 25, which breaks SMTP even with correct credentials.
- A block on postfix-sasl or exim sits in that jail, not in sshd. Unban the jail that holds the address.
- An RBL listing affects delivery to Gmail or Outlook, not your ability to log in. Check SPF, DKIM, and DMARC under Email Deliverability in cPanel before requesting a delisting.
- A shared server IP can be listed because of another account, and only the host can request that delisting.
Test the port with openssl s_client -connect mail.example.com:465 -quiet. A certificate and a server greeting mean the port is open; a timeout means the firewall or the ISP is dropping it.
Whitelist one IP without opening the server
Whitelisting is a decision about trust, not a repair for a bad password. Add one address, never a range.
csf -a 203.0.113.10 "office static IP"thencsf -radds a comment and applies the rule.- Only for a static address. A dynamic broadband IP changes, and the old entry then protects a stranger.
- Never add 0.0.0.0/0 or 0.0.0.0/1. That turns the firewall off for every address on the internet.
- cPanel's IP Blocker has no allow list. It only denies, so the fix there is to remove the entry.
- A WordPress security plugin keeps its own allow list in its settings, separate from CSF.
Record why each entry exists. An allow list without comments becomes a list nobody dares to prune, and the next person inherits a server with a permanent hole. If tuning these lists is not your job, managed website security covers the firewall and the application layer together.
Verify the unblock from the same connection
Reload the exact URL on the same network. A private window changes cookies, not your public IP, so it cannot prove an unblock.
curl -I https://example.comshould return 200 or 301, not 403.csf -gshould show no deny and no temporary deny for the address.fail2ban-client status sshdshould no longer list it.- A colleague on a different network should be able to open the same URL; if it loads for them only, the block is still on your address.
A 403 after the delete usually means a second entry, because the IP Blocker page and the server firewall are different lists. A timeout after the delete points at CSF or the host's upstream filter, not at the account.
When the firewall belongs to your host
On shared hosting, cPanel may show an empty IP Blocker because the block sits in the host's own firewall. That firewall is not yours to edit, and no amount of deleting in cPanel will clear it.
Email support@webji.services with the public IP from ifconfig.me, the time with the timezone, the URL, the exact error text, and what you already cleared. Support runs 24/7 in Hindi and English, and the average first reply is under 60 minutes. The Jaipur office phone is not a support line, so use the contact form for account work.
If the site sits behind Cloudflare, open Security, then WAF, then Tools, and read the IP Access Rules. A Cloudflare block never appears in cPanel, and it will survive every unblock you try on the server.
Frequently Asked Questions
Why is my IP blocked from my own website?
Repeated failed logins, a WordPress security plugin, ModSecurity, or a server firewall such as CSF or fail2ban blocked it. The error page names the layer. Start with cPanel, then Security, then IP Blocker; if that list is empty, the block sits above your account.
How do I unblock my IP in cPanel?
Log in to cPanel, open Security, then IP Blocker. Find your address under Currently Blocked IP Addresses and click Delete. Reload the site from the same connection. If the list is empty, the block is at server level: use csf -g on a VPS or email your host.
How do I remove a blocked IP in CSF?
Run csf -g YOUR.IP to see which list holds it. Use csf -dr YOUR.IP for a permanent deny or csf -tr YOUR.IP for a temporary one, then csf -r to apply the rules. Confirm with csf -g that the address no longer appears as denied.
How long do firewall IP blocks last?
A fail2ban or LFD temporary ban lasts as long as that jail's bantime, often minutes to a day, and the recidive jail can hold a repeat offender for a week. A cPanel IP Blocker or csf.deny entry is permanent until someone deletes it.
Why does my IP keep getting blocked?
Usually a saved wrong password in a mail app or FTP client retries on a schedule and trips the same jail again. Fix the stored credential, then unban. A cron job or backup script hitting an old URL does the same thing.
How do I find my current IP address?
Run curl -4 ifconfig.me in a terminal, or open a what-is-my-IP page in the browser. On mobile data the address changes when you reconnect. Behind an office router, every desk shares one public address, so one colleague's failed logins can block the whole office.