The server firewall counts failed attempts and, after a few, cuts off that address. It is not punishment or suspicion: it is what stops the automated attacks that knock on the door thousands of times a day from bringing the server down.
The trouble is that the firewall cannot tell an attacker from a forgotten phone holding an old password. And since a whole office reaches the internet through one address, a single insistent device is enough to lock everyone out.
The number one cause, by far
A mailbox password was changed, but stayed out of date somewhere: someone's phone, an Outlook on a computer nobody uses, the printer that e-mails scans, a website that sends form submissions. That device reconnects on its own every few minutes, fails every time, and after half a dozen attempts the office address is blocked.
Note the cruel detail: the person locked out is not the one with the wrong password — it is everyone sharing that connection. Which is why it feels like "the server is down" while the site is perfectly up for the rest of the world.
What the firewall counts, and when it blocks
Counting is done per hour and per address:
| Where it failed |
Attempts before a block |
| cPanel or webmail login |
5 |
| Sending mail (SMTP) |
5 |
| SSH |
5 |
| Website security rules (ModSecurity) |
5 |
| Receiving mail (IMAP or POP3) |
10 |
| FTP |
10 |
|
These blocks do not expire on their own. Contrary to what most people expect, waiting half an hour will not do it: the block stays until it is lifted by hand. And if you ask for an unblock without fixing the cause, the device tries again and the address is blocked within minutes. Fix first, unblock after.
|
How to tell it really is a block
| 1 |
Everything stops at once — site, webmail, cPanel, e-mail. If it were the site, e-mail would keep working.
|
|
| 2 |
It hangs until it gives up, instead of showing an error message. A block does not answer; an error answers.
|
|
| 3 |
On your phone with mobile data, it works. This is the decisive test: turn off Wi-Fi and try. If it works that way, the problem is the address of the network you were on.
|
|
What to do
| 1 |
Run the mobile-data test to confirm.
|
|
| 2 |
Find the guilty device before asking for an unblock: think about which password changed recently and which devices used it — including the ones nobody has switched on for months.
|
|
| 3 |
Fix or switch off that device.
|
|
How to stop it happening again
| 1 |
When you change a mailbox password, update it on every device the same day. Make the list before the change, not after.
|
|
| 2 |
When someone leaves the company, delete the mailbox or change the password and remove the account from their phone. A phone nobody controls keeps trying for months.
|
|
| 3 |
Do not forget printers and systems that send mail on their own. They are the suspects nobody remembers to check.
|
|
| 4 |
On FTP, keep to 2 to 4 simultaneous connections and do not keep retrying with the wrong username — see common FTP errors .
|
|
| 5 |
If you are guessing your way into the panel, stop: reset the password instead of trying five more times.
|
|
|
A verification screen is not a block. If you get a page asking you to confirm you are not a robot, that is the site protection filtering automated traffic. Complete it and carry on. A real block shows no page at all.
|
|
What if the blocked address is a customer of yours? It happens to online shops: a customer or an external service gets blocked. Send us their address and the time, and we will check the reason before releasing it.
|
Not sure what your address is? See how to find your public IP — it takes ten seconds and it is the first thing we need.
