How To Resolve cPanel Large Number of Failed Login Attempts from IP Error

How To Resolve cPanel Large Number of Failed Login Attempts from IP Error

If you have received the following message from your server:


Subject: Large Number of Failed Login Attempts from IP


5 failed login attempts to account root (system) — Large number of attempts from this IP:

Origin Country: <Country Name>

Please use the following links to add to the black list:


What Does This Message Mean?

WHM/cPanel has a brute force protection service called “cPHulk Brute Force Protection”.

If someone enters an incorrect password several times, cPHulk blocks the offending IP address and sends the message to the root contact on the server.

If cPHulk blocks your IP, you can add it to white list via WHM by following the steps below:

How To Resolve The Issue 

    1. Go to WHM Main, then to Security Center, and select cPHulk Brute Force Protection

       2.  Go to “Whitelist Management” Tab.

      3. Enter the IP in “New Whitelist Records” and press “Add”

If you received a notice regarding a blocked IP, you should log into WHM and check the IP:

  1. Go to WHM Main, then to Security Center, and choose cPHulk Brute Force Protection.
  2. Go to the “History Reports” tab.

Here you can see “User” and “IP” where someone tried to connect. You should block this IP via “Blacklist Management” if you don’t recognize it tab.

We recommend setting up a firewall (ex: CSF installation instructions here) and add this IP to the “deny list”.

Information on how to set up cPHulk Brute Force Protection (official documentation) can be found here.

    • Related Articles

    • Install ConfigServer Firewall On A cPanel Server

      ConfigServer Firewall (CSF) is a popular Linux firewall security suite. It is easy to install, flexible to configure and secure with extra checks. CSF helps control exactly how much traffic is allowed in and out of the server to protect the server ...
    • How To Restart IP Pool via cPanel Scripts

      If you have additional IPs added in WHM/Cpanel it may not bring them up after network restart. In order to fix this behavior run the following command: /scripts/restartsrv_ipaliases to make aliases available on network interface again.
    • Login control panel

      This article is about how to log in control panel.
    • How To Use Shoutcast

      A single install of a shoutcast server has been installed, simply login as the shoutcast user either by setting the password (passwd shoutcast) or switching user (su shoutcast) and in /home/shoutcast begin configuring sc_serv.conf to get your first ...
    • Internal IPs

      Internal IP’s Category: Networking &nbsp All cloud VPSes allow up to 2 free internal IP’s per node that can be used between all VMs in a cloud. All traffic between private IP’s isn’t counted towards your bandwidth quota and can be used for ...