Global blocklist

The global blocklist holds addresses and networks that must not reach any site on the server. The bans of DDoS protection and Bot Fight Mode are temporary and kept in memory; the blocklist is stored on disk, survives restarts and applies to all sites at once.

Find it under Advanced > Security in the main menu, card Blocked IPs. Type an address or a network, optionally a note (up to 200 characters, for example “scraper, March”), and press Block. Each entry in the list has its own button to remove it.

How it applies

The blocklist is the first protection check, and it runs on every request to every site, including sites with all protection turned off. It also overrides the site’s allow list: an address on both lists is blocked. An entry in the blocklist is a deliberate decision by the panel admin, while the allow list only exempts addresses from the automatic rules.

Blocked requests get a 404, or the site’s Bot Fight block page if one is set, and count as “blocklisted” in each site’s statistics. The list holds up to 10 000 entries.

The blocklist works with the visitor’s real address. For a site behind Cloudflare, turn on Behind Cloudflare; otherwise every request comes from a Cloudflare address and the panel never sees the blocked visitor’s own address.

What you can enter

Single addresses and networks in CIDR notation, IPv4 and IPv6:

203.0.113.7
198.51.100.0/24
2001:db8:abcd::/48

Networks are parsed strictly, here and in the sites’ allow lists:

• 1.2.3.4/ is rejected as an error; it is never read as the whole internet.
• /0 is an error in the blocklist, since nobody wants to block every address.
• The widest network you can block is a /8 for IPv4 and a /19 for IPv6. Anything wider is refused.

Canonical forms

Entries are stored in one canonical form, so the same address cannot be listed twice under different spellings:

• 1.2.3.4/32 is stored as 1.2.3.4, FE80::1 as fe80::1, ::ffff:1.2.3.4 as 1.2.3.4.
• An address with bits past the prefix, such as 203.0.113.7/24, is stored as the network it belongs to, 203.0.113.0/24, and the panel tells you so.
• Entries saved by older versions are converted to this form when the panel starts, with a warning in the log. Entries that cannot be read at all are ignored and also logged; remove them and add them again.

Export and import

The blocklist is part of the settings export, together with all sites. On import, the entries from the file are added to the existing list. Invalid entries and duplicates are skipped, and the panel reports them.