You type your cPanel or WHM password, hit enter, and instead of your dashboard you get a blunt message: "Your account has been temporarily suspended due to too many failed login attempts" or simply a connection that times out. Nothing looks wrong with your password. You just can't get in. Nine times out of ten, this is cPHulk Brute Force Protection doing exactly what it's designed to do — except this time it's blocking you, not an attacker.
Symptom: cPanel or WHM Won't Let You Log In
The tell-tale signs of a cPHulk block:
- The login page says your account or IP is temporarily blocked
- You get redirected back to the login form with no error, over and over
- WHM stops responding on port 2087 even though the server is clearly up (you can still ping it or reach the site)
- It happens right after a few mistyped passwords, a saved-but-wrong password in a script, or an old bookmark that auto-submits stale credentials
cPHulk is cPanel's built-in brute force protection. It watches login attempts across cPanel, WHM, webmail, and FTP, and once a source IP crosses a failure threshold, it blocks that IP outright for a set period — usually somewhere between 15 minutes and several hours depending on configuration.
Cause: Why cPHulk Blocked You
cPHulk doesn't know the difference between an attacker and you fat-fingering your password twice before autocomplete kicks in. It just counts failures. Common ways people trigger it on their own server:
- Saved credentials that changed. A password manager or browser autofill still has the old password after a reset.
- A script or cron job hitting the cPanel/WHM API with an expired API token or wrong password, retrying every few minutes.
- Shared office or NAT IP. One colleague's typo counts against everyone behind the same public IP.
- Dynamic IP that was previously flagged. Your ISP handed you an address that was recently used by someone else who got blocked.
- Aggressive thresholds. If cPHulk's "Maximum Failed Logins" is set very low (say, 2 or 3), even a legitimate slow typer trips it.
The good news: this is a configuration issue, not a hack or a broken server. Fixing it takes a couple of minutes once you know where to look.
Fix: Remove the Block
How you fix this depends on whether you have root/WHM access to the server or you're on shared hosting under someone else's account.
Option 1: Unblock via WHM (Root Access)
If you or your hosting provider has WHM root access on the server:
- Log into WHM (you may need to use the server's IP directly on port 2087 if the block is IP-based and you're currently locked out of the hostname too)
- Go to Security Center » cPHulk Brute Force Protection
- Open the IPs currently blocked tab
- Find your IP in the list and click Remove
If you can't reach WHM at all because your IP is blocked there too, skip to the whitelist step below using an alternate connection (mobile hotspot, VPN) so you can get in and clean things up properly.
Option 2: Unblock from the Command Line (VPS/Dedicated Server)
If you manage your own VPS and have SSH access as root, you can clear the block directly. Newer cPanel versions store cPHulk data in a MySQL database:
mysql -e "DELETE FROM cphulkd.brutes WHERE IP='YOUR.IP.ADDRESS.HERE';"
mysql -e "DELETE FROM cphulkd.logins WHERE IP='YOUR.IP.ADDRESS.HERE';"Replace the placeholder with the actual blocked IP. You can find out what IP the server sees for you by running curl ifconfig.me from the machine you're trying to log in from. Restart cphulkd afterward for good measure:
/usr/local/cpanel/scripts/restartsrv_cphulkdOption 3: On Shared Hosting (No Root Access)
If you're on a shared cPanel account and don't have WHM access, you can't remove the block yourself — only the server admin can. Open a support ticket with your host and give them:
- Your account username or domain
- The public IP you're connecting from (check whatismyip.com or similar)
- Roughly when the block started
A support engineer can clear the block from WHM in under a minute once they have that IP.
If You're in a Hurry: Temporarily Disable cPHulk
As a last resort, root users can turn cPHulk off entirely from WHM » Security Center » cPHulk Brute Force Protection by switching it to Disable. This gets you back in immediately, but leaves logins completely unprotected against actual brute force attempts. Turn it back on the moment you're done troubleshooting — don't leave it off.
Prevention: Stop Getting Blocked by Your Own Firewall
Once you're back in, spend five minutes making sure this doesn't happen again.
Whitelist Your Static IPs
In WHM » Security Center » cPHulk Brute Force Protection, open the White/Black List Management tab and add the office, home, or admin IPs you log in from regularly. Whitelisted IPs skip the failure counter entirely.
Tune the Thresholds
The default settings are reasonable for most sites, but if your team is large or shares a NAT IP, consider raising:
| Setting | What it does |
|---|---|
| Failures before IP block | How many bad logins from one IP before it's blocked |
| Failures before username block | Same, but tracked per account instead of per IP |
| Brute Force Protection Period | How far back failed attempts are counted |
| IP Based Block Time | How long the block lasts once triggered |
Bumping the failure threshold from 2-3 up to 5-6 cuts down on false positives without meaningfully weakening protection against real attacks.
Fix the Root Cause
If a cron job or script is what's actually tripping cPHulk, that's the real problem — fix the credentials or API token it's using rather than just clearing blocks over and over. Check the cPHulk log in WHM to see which account and source is failing repeatedly.
Use Two-Factor Authentication Instead of Relying Only on Lockouts
cPHulk protects against automated password guessing, but it's a blunt instrument. Enabling two-factor authentication on cPanel and WHM accounts means a leaked or guessed password isn't enough to get in on its own, which reduces how much you need to lean on aggressive lockout thresholds in the first place.
Frequently Asked Questions
What exactly is cPHulk Brute Force Protection?
It's a security service built into cPanel and WHM that monitors login attempts across cPanel, WHM, webmail, and FTP. When a specific IP or username fails to log in too many times within a set window, cPHulk temporarily blocks further attempts from that source.
Why did cPHulk block my own IP if I know my password is correct?
cPHulk only counts failed attempts — it doesn't know who's typing. A few mistyped passwords, an old saved password in a browser or app, or a misconfigured script retrying with bad credentials can trip the same threshold an actual attacker would hit.
How long does a cPHulk block usually last?
It depends on the server's configuration, but the default block period is commonly around an hour. Some servers set it shorter or longer. You don't have to wait it out — removing the block manually from WHM or the command line takes effect immediately.
Can I permanently whitelist my IP so this never happens again?
Yes. In WHM go to Security Center » cPHulk Brute Force Protection » White/Black List Management and add your static IP to the whitelist. This only works well for IPs that don't change; if your ISP assigns a dynamic IP, whitelisting isn't reliable long-term.
Does disabling cPHulk affect SSH login attempts too?
No. cPHulk covers cPanel, WHM, webmail, and FTP logins. SSH brute force attempts are typically handled separately by tools like CSF/LFD or fail2ban, so disabling cPHulk has no effect on SSH protection.
