IP blocked by the server firewall: why it happens and how to unblock it
PrintIf your website, cPanel, FTP or e-mail suddenly stops responding from your office or home, while it works fine from a phone on mobile data, the server firewall has most likely blocked your IP address. This happens automatically after repeated failed logins or suspicious traffic from that address. To lift the block, send us your IP address in a ticket; to keep it from coming back, find the device or program that caused it.
How to recognise a firewall block
- The site, cPanel, webmail or FTP time out from one network only. From another connection everything works.
- Every device behind the same router is affected at once, because they all share one public IP address.
- It started right after a password change, a new phone or a newly configured mail program.
A block is different from a 403 error on one page (that is the web application filter, see the 403 error from ModSecurity) and from a CAPTCHA page shown before the site (see a CAPTCHA page instead of the website).
How to get unblocked
- Find your public IP address: from the blocked network, search for "what is my IP" in Google, or open any IP check page.
- Open a support ticket and write the IP address, the domain or service you could not reach, and roughly when it began. If the client area does not open from the blocked network either, use mobile data or call us at +373 795-800-80 (9:00 to 21:00).
- We check the firewall log, tell you the reason recorded for the block and remove it.
Before you write, fix the cause if you already know it (see below). Otherwise the address is blocked again within minutes.
Why an IP address gets blocked
When we tell you the reason, it comes as a line from the firewall log. The most common ones, with the thresholds currently set on our servers:
| Log entry | What happened | What to check |
|---|---|---|
| (smtpauth) Failed SMTP AUTH login | 5 failed attempts to send mail with a wrong password within 5 minutes | A phone, Outlook or another mail program still uses an old password, or a mailbox was deleted but is still set up on a device |
| (pop3d) Failed POP3 login | 10 failed mail downloads over POP3 within 5 minutes | The same as above, for receiving mail. Settings: setting up mail clients |
| (ftpd) Failed FTP login | 10 failed FTP logins within 5 minutes | A wrong password saved in FileZilla or another FTP program; if you did not try to connect, someone may be guessing the password |
| (sshd) Failed SSH login | 5 failed SSH connections within 5 minutes | The username, port and key or password; SSH must be enabled for your account first, see connecting via SSH |
| Failed cPanel login | 10 failed logins to cPanel within 5 minutes | The username and password; reset the password if you are not sure of it |
| mod_security triggered | Requests from your IP matched the web attack rules 5 times within 5 minutes | A form, plugin or tool that sends unusual requests; tell us what you were doing when it happened |
| Port Scan detected | Your IP tried many ports of the server, as attackers do before an attack | Network scanners, some monitoring tools, or malware on a computer in your network |
How to avoid new blocks
- After changing a password, update it everywhere at once: phones, tablets, the computer's mail program, FTP programs, website forms that send mail through SMTP. One forgotten device is the most common reason a whole office gets blocked.
- Remove mailboxes from devices before you delete them in cPanel.
- Do not guess passwords. After two failed attempts, reset the password instead: where to reset each password.
- Scan your computers if the log shows failed logins you did not make or a port scan. Malware on one machine can get the whole network blocked.
Frequently asked questions
Can you whitelist my IP address permanently?
The firewall is a shared protection for all clients on the server. If you work from a fixed IP address and have a real need (for example a remote database connection, see connecting remotely to MySQL), describe it in a ticket and we will look at what can be done.
My IP address changes. Do I still need to send it?
Yes, send the address you have at the moment of the block. If your provider gives you a new address, the block may seem to vanish by itself, but the cause is still there and the next address will be blocked too.
Will the block expire on its own?
Some blocks are temporary, others stay until we remove them. Do not wait: write to us, especially if your mail stops working.
