Unblock an IP Address

Run curl -4 ifconfig.me in a terminal to print the IPv4 address the internet sees. Add -6 to check whether IPv6 is in play, because a server can block one family while the other still works.

Then test whether the request reaches the server: curl -sS -o /dev/null -w "%{http_code}\n" https://example.com. A number such as 200 or 403 means something answered. A timeout or a reset means a network firewall dropped the packet before the web server saw it, which points at CSF or the host rather than WordPress.

Behind an office router every desk shares one public address, so a colleague's failed logins block the whole office. On mobile data the address changes when the phone reconnects, which is why a block can appear to clear itself on a phone and not on the desktop.

CSF and LFD run on a VPS or dedicated server and need root SSH access. Each command changes one list, and the reload applies it.

• csf -g 203.0.113.10 shows every list that mentions the address: csf.deny, csf.allow, or a temporary deny.
• csf -dr 203.0.113.10 removes a permanent deny, then csf -r reloads the rules.
• csf -tr 203.0.113.10 removes a temporary LFD deny without touching the permanent list.
• csf -a 203.0.113.10 adds the address to csf.allow, for a static IP you control.

Change the address in every command. The -dr and -tr flags edit the file; without csf -r the running rules keep dropping the packet until the next restart. You know it worked when csf -g prints neither a deny nor a temporary deny for that address.

Whitelist one IP without opening the server

Whitelisting is a decision about trust, not a repair for a bad password. Add one address, never a range.

• csf -a 203.0.113.10 "office static IP" then csf -r adds a comment and applies the rule.
• Only for a static address. A dynamic broadband IP changes, and the old entry then protects a stranger.
• Never add 0.0.0.0/0 or 0.0.0.0/1. That turns the firewall off for every address on the internet.
• cPanel's IP Blocker has no allow list. It only denies, so the fix there is to remove the entry.
• A WordPress security plugin keeps its own allow list in its settings, separate from CSF.

Record why each entry exists. An allow list without comments becomes a list nobody dares to prune, and the next person inherits a server with a permanent hole. If tuning these lists is not your job, managed website security covers the firewall and the application layer together.

A block that returns within the hour is a loop, not bad luck. Something keeps retrying the same failed login, so read the trigger before you clear the entry a second time.

• /var/log/lfd.log records each CSF deny with the rule and the port.
• /var/log/fail2ban.log names the jail, the filter, and the line that matched.
• ~/access-logs/example.com is the account's web log in cPanel, useful for the 404s and POSTs that tripped ModSecurity.
• /usr/local/apache/logs/modsec_audit.log holds the rule ID and the request that matched, on a WHM server.
• /var/log/exim_mainlog records SMTP authentication failures, which is what a mail jail reacts to.

Start with grep '203.0.113.10' /var/log/lfd.log | tail -5. The last field names the rule: LF_SSHD for an SSH password failure, LF_SMTPAUTH for a mail password, LF_MODSEC for a web request. Unblocking without that line guarantees a repeat.

Reload the exact URL on the same network. A private window changes cookies, not your public IP, so it cannot prove an unblock.

• curl -I https://example.com should return 200 or 301, not 403.
• csf -g should show no deny and no temporary deny for the address.
• fail2ban-client status sshd should no longer list it.
• A colleague on a different network should be able to open the same URL; if it loads for them only, the block is still on your address.

A 403 after the delete usually means a second entry, because the IP Blocker page and the server firewall are different lists. A timeout after the delete points at CSF or the host's upstream filter, not at the account.

When the firewall belongs to your host

On shared hosting, cPanel may show an empty IP Blocker because the block sits in the host's own firewall. That firewall is not yours to edit, and no amount of deleting in cPanel will clear it.

Email support@webji.services with the public IP from ifconfig.me, the time with the timezone, the URL, the exact error text, and what you already cleared. Support runs 24/7 in Hindi and English, and the average first reply is under 60 minutes. The Jaipur office phone is not a support line, so use the contact form for account work.

If the site sits behind Cloudflare, open Security, then WAF, then Tools, and read the IP Access Rules. A Cloudflare block never appears in cPanel, and it will survive every unblock you try on the server.

Sources: cPanel documentation for IP Blocker; CSF readme for -g, -dr, -tr, -a and -r; fail2ban-client manual; Cloudflare documentation for IP Access Rules.