Host Access Control

Valid for versions 82 through 90





Last modified: December 16, 2020


If you accidentally lock yourself out of WHM when you use this interface, edit the /etc/hosts.allow file through the command line to regain access.

The Create Support Ticket interface (WHM >> Home >> Support >> Create Support Ticket) automatically adds cPanel Support’s IP addresses to the server’s /etc/hosts.allow file. For more information, read our Create Support Ticket documentation.

Use this interface to allow or deny (block) access to the following services for specific IP addresses:

  • cPanel (cpaneld)
  • WHM (whostmgrd)
  • Webmail (webmaild)
  • Web Disk (cpdavd)
  • FTP (ftpd)
  • SSH (sshd)
  • SMTP (smtp)
  • POP3 (pop3)
  • IMAP (imap)
  • To control access to the ftpd daemon, you must use the ProFTPD FTP server. Pure-FTP does not support TCP wrappers.

  • To control access to the POP3 or IMAP services, you may use the Dovecot mail servers.

Allow or deny access for an IP address


You must enter your allow rules before your deny rules.

To allow or deny an IP address to access a service, perform the following steps:

  1. Enter the service name in the daemon text box.

  2. Enter the IP address or hostname in the Access List text box.

    • You may enter wildcards in this text box.

    • You must enclose IPv6 addresses in square brackets ( [ ] ).

    • You cannot enter a range of IPv4 addresses with CIDR notation.

    • To specify a network range, add a network mask to the IP address.

      • IPv4 example:, where is the desired network mask you want to use.

      • IPv6 example: [2001:0db8:0:0:1:0:0:1]/64, where /64 is the desired CIDR-notation network mask you want to use.

  3. Enter the desired action in the Action text box.

    • Enter allow to allow access.

    • Enter deny to deny access.

  4. Describe the rule in the Comment text box.

  5. Click Save Host Access List, or click Reload to delete any changes.


You can also enter ALL EXCEPT IP address in the Access List text box. When you enter allow as your action, the system will allow all of the addresses except for addresses that you entered in the Access List text box.


To allow access for two IP addresses, but deny access from all other addresses, use either of the following methods:

Create two separate rules:

  • Create one rule that allows or [2001:0db8:0:0:1:0:0:1]/64.

  • Create a second rule that denies access to ALL IP addresses.

Create one rule:

  • Enter all except or all except [2001:0db8:0:0:1:0:0:1]/64 in the Access List text box.

  • Enter deny in the Action text box.

Additional Documentation