Unblocking IPs from cPanel cPHulk Brute Force Protection

Locked Out of Your Own Server?

cPHulk is cPanel's built-in brute force protection system. It monitors failed login attempts to cPanel, WHM, SSH, and email accounts. If you (or a script on your office network) fail a login too many times, cPHulk will block your IP. You won't even see the login page—the connection will simply time out or reject.

1. Unblocking via WHM (If You Have Another IP)

The easiest fix is to switch to a different network (like your mobile phone hotspot).

1. Log into WHM using the new IP.
2. Navigate to Security Center > cPHulk Brute Force Protection.
3. Go to the History Reports tab, find your blocked office IP, and click Remove block.
4. Go to the Whitelist Management tab and add your office IP to prevent future lockouts.

2. Unblocking via SSH (Command Line)

If you have SSH access (and your SSH port isn't also blocked for that IP, or you can SSH from a different server), you can whitelist the IP via CLI.

Run the whitelist script provided by cPanel:

/usr/local/cpanel/scripts/cphulkdwhitelist 103.X.X.X

If cPHulk itself is malfunctioning or locking everyone out, you can disable it entirely via SSH:

whmapi1 configureservice service=cphulkd enabled=0 monitored=0
/usr/local/cpanel/etc/init/stopcphulkd

(Remember to re-enable it after fixing the root cause!)

3. Clearing the Database Manually

In extreme cases, you can interact directly with the cPHulk MySQL database to clear the block lists:

mysql -e "truncate table cphulkd.brutes;"
mysql -e "truncate table cphulkd.logins;"

---

Don't let rogue security tools halt your operations. At JagaWeb, we configure resilient access controls and IP whitelisting for strict environments like nCrypt.

Regain absolute control of your infrastructure with our RM5,000 Ownership & Access Review, and prevent accidental lockouts with active monitoring via our RM450/month Care Plan.