Updated: 28 September 2026 · Applies to: Apache 2.4 (.htaccess)
You can stop specific IP addresses from opening your website with a few lines in .htaccess.
Block one or more addresses (Apache 2.4)
<RequireAll>
Require all granted
Require not ip 203.0.113.7
Require not ip 198.51.100.0/24
</RequireAll>
Put the block in the .htaccess file of public_html. Blocked visitors get a "403 Forbidden" error.
Tip: In cPanel, Security › IP Blocker creates these rules for you.
Note: Behind Cloudflare or another proxy, the server sees the proxy's address, so block the visitor in the proxy instead. The old Order allow,deny / Deny from syntax belongs to Apache 2.2 and should not be mixed with Require rules.
