How to Block IP Addresses with .htaccess (Step by Step)

Introduction

The .htaccess file lets you apply access rules to a website without touching the server’s main configuration. One of its most useful features is blocking an IP address that’s making unauthorized access attempts, sending spam, consuming resources, or generating suspicious requests.

In this guide you’ll see how to block a single IP with .htaccess, block several addresses, restrict entire ranges, and protect only a specific folder or file.

Important: back up your .htaccess file before editing it. A syntax error can trigger a 500 Internal Server Error on your site.

Where to find the .htaccess file

The .htaccess file is normally located in your website’s main folder, usually called public_html.

To find it in cPanel or DirectAdmin:

1. Log in to your hosting control panel.
2. Open the File Manager.
3. Go into the public_html folder for your domain.
4. Enable the option to show hidden files, if the file doesn’t appear.
5. Locate and edit the .htaccess file.

If it doesn’t exist, you can create a new file named exactly .htaccess. The leading dot is part of the name.

How to block an IP in Apache 2.4

Apache 2.4 uses the Require directive to control access by IP address. Add this code to .htaccess:

<RequireAll>
    Require all granted
    Require not ip 203.0.113.10
</RequireAll>

Replace 203.0.113.10 with the IP you want to block. The first line allows general access and the second one excludes that address. Visits from that IP will normally receive a 403 Forbidden error.

Don’t use Require not ip on its own. The negation must be combined with a positive condition, such as Require all granted, inside <RequireAll>.

How to block several IP addresses

To block several IPs, add one Require not ip line per address:

<RequireAll>
    Require all granted
    Require not ip 203.0.113.10
    Require not ip 198.51.100.25
    Require not ip 192.0.2.80
</RequireAll>

It’s a good idea to leave a short note about why each address was blocked:

<RequireAll>
    Require all granted

    # IP blocked for repeated login attempts
    Require not ip 203.0.113.10
</RequireAll>

Lines starting with # are comments — Apache ignores them.

How to block a range of IP addresses

If the unwanted requests come from the same network, you can block the whole range using CIDR notation:

<RequireAll>
    Require all granted
    Require not ip 203.0.113.0/24
</RequireAll>

This example blocks the range from 203.0.113.0 to 203.0.113.255. You can also block an IPv6 network:

<RequireAll>
    Require all granted
    Require not ip 2001:db8:1234::/48
</RequireAll>

Blocking a range affects many addresses at once. Double-check the network before saving the change so you don’t also block legitimate visitors.

How to block an IP only in one folder

Rules in a .htaccess file affect the folder it’s in and, normally, its subfolders. To block an IP only in a specific section:

1. Go to the folder you want to protect.
2. Create or edit the .htaccess file inside that folder.
3. Add the blocking rule:

<RequireAll>
    Require all granted
    Require not ip 203.0.113.10
</RequireAll>

That way, the IP can still visit the rest of the site, just not the content protected by that .htaccess file.

How to block an IP only for one file

You can also restrict access to a specific file, such as a login page:

<Files "wp-login.php">
    <RequireAll>
        Require all granted
        Require not ip 203.0.113.10
    </RequireAll>
</Files>

The address will only be blocked when trying to open wp-login.php. You can replace that name with another file, such as admin.php or login.php.

How to allow access to only one IP

If you need to close off a section to the public and allow access only from one address, use:

Require ip 203.0.113.10

This is useful for private areas, staging environments, or internal tools. Before applying it, make sure your connection uses a fixed IP — if your ISP changes your public IP, you could lock yourself out.

Legacy syntax for Apache 2.2

Older configurations used the Order, Allow, and Deny directives:

Order Allow,Deny
Allow from all
Deny from 203.0.113.10
Deny from 198.51.100.25

These directives are deprecated in Apache 2.4. Prefer the Require syntax, and don’t mix both formats in the same block — it can produce unexpected results.

How to check if the block is working

After saving the file:

1. Open the site from a connection using the blocked IP.
2. Confirm the server responds with 403 Forbidden.
3. Check that the site still works from other connections.
4. Check the error log if you see a 500 error.

To test from another IP, you can use your phone’s mobile data connection instead of your usual wifi.

Common problems

A 500 Internal Server Error appears

This usually means Apache doesn’t recognize a directive, or there’s a syntax error. To restore the site:

1. Access File Manager or connect via FTP.
2. Open the .htaccess file.
3. Remove or comment out the lines you just added.
4. Save the file and reload the page.

Check in particular that the <RequireAll> and </RequireAll> tags are correctly opened and closed.

The IP is still getting through

Check the following:

• The IP address you entered may be wrong.
• The .htaccess file may be in a different folder.
• The server may not have .htaccess rule reading enabled.
• The site may be behind a proxy, load balancer, or CDN.
• You may be looking at a cached page.
• The visitor’s IP may have changed if they use a dynamic IP.

If there’s a proxy in front of the server, Apache may see the intermediary’s IP instead of the visitor’s real address. In that case, contact support before blocking entire ranges.

I’ve locked myself out

Access .htaccess from File Manager or via FTP and remove the rule containing your IP. If you blocked a range, temporarily replace the file with the backup you made before the change.

If you’ve lost access to the control panel itself, not just the website, check our article on what to do if the server has blocked your IP.

The block is affecting legitimate users

This usually happens when blocking an entire network. Remove the range and block only the specific addresses causing the problem.

Security tips

• Confirm the IP in your access logs before blocking it.
• Back up your .htaccess file before every change.
• Only use CIDR ranges when you know exactly which addresses they include.
• Review old blocks periodically.
• Don’t rely on .htaccess as your only defense against intensive or distributed attacks — the server firewall already filters out a lot of that traffic automatically.
• Keep your site, plugins, themes, and apps up to date.
• Keep recent backups so you can restore the site if anything goes wrong.

Blocking via .htaccess only affects web access handled by Apache. It doesn’t automatically block other services like email, FTP, SSH, or the control panel.

If you’re getting malicious requests from many different addresses, blocking them one by one may not be enough. In that case, it’s worth reviewing your site’s security and confirming your hosting plan has the resources it needs for its real traffic.

Frequently asked questions

Can I block an IP without accessing the server configuration?

Yes. If your hosting allows .htaccess (as every miHosting plan does), you can apply the block from File Manager or via FTP.

Will the blocked user see any message?

They’ll normally get a 403 Forbidden response, indicating the server rejected the request.

Can I block an IPv6 address?

Yes. Apache 2.4 supports IPv4 addresses, IPv6 addresses, and networks in CIDR notation.

Can I block an entire country with .htaccess?

It’s not recommended to do this with a manual list of IP ranges — allocations change over time, and an incomplete list can end up blocking legitimate users. For geographic restrictions, a dedicated security tool is a better fit.

Does blocking an IP reduce resource usage?

It can reduce the requests coming from that address, but the server still has to process the connection and check the rule. Large or distributed attacks need additional measures at the firewall or infrastructure level.

What happens if the visitor’s IP changes?

The block stops affecting them. Many residential and mobile connections use dynamic IPs that change periodically.

Conclusion

To block an IP with .htaccess in Apache 2.4, use a <RequireAll> block that allows general access and excludes the address with Require not ip.

Always back up the file before editing it, and avoid blocking entire ranges without checking them first. If you get a 500 error, lose access, or the block doesn’t work, restore the previous file and contact miHosting support to review the configuration.