Locked out by Wordfence, Cloudflare or your host’s firewall

When a firewall blocks your IP address, the site won't load, or you get a page saying your access is limited. It happens, for example, after many failed logins, after you did something the firewall treated as an attack, or because your IP address is on a list of addresses used in attacks.

The firewall can be in one of three places: in WordPress (for example Wordfence), at Cloudflare in front of the site, or on your host's server. Each is unblocked differently, so first find out which firewall blocked you.

Check whether your IP address is blocked

1. Turn off Wi-Fi on your phone and open the site over mobile data.
2. If the site works there but not on your computer, your IP address is blocked.
3. Open whatsmyip.org on your computer and note your IP address. You'll need it in the steps below.

Find out which firewall it is

Look at the page that stops you:

• If it says "Your access to this site has been limited by the site owner", "Your access to this site has been temporarily limited by the site owner" or "Generated by Wordfence", it's Wordfence.
• If the page has the Cloudflare logo and a Ray ID at the bottom, for example with "Error 1020: Access denied", it's Cloudflare.
• A plain error page with neither, or a site that doesn't load at all, points to your host's firewall.

Wordfence

The lockout page has a field for administrators. Enter the email address of your administrator account and click "Send Unlock Email". The email contains a link that lifts the block.

If the email doesn't arrive, deactivate Wordfence over FTP:

1. Connect with FTP or the file manager in your hosting panel, and open wp-content/plugins.
2. Rename the wordfence folder, for example to wordfence-off. This turns off all of Wordfence, including the firewall.
3. Log in to wp-admin.
4. Rename the folder back to wordfence, and check under Plugins that Wordfence is active.
5. Find the block under Firewall in the Wordfence menu and remove it.

Cloudflare

Only someone with access to the Cloudflare account for the domain can remove a block there.

1. Take a screenshot of the block page, with the Ray ID and the time.
2. Log in to Cloudflare, select the domain and go to Security → Analytics. Open the Events tab and search for the Ray ID or your IP address.
3. The event shows which rule blocked you. Adjust the rule, or add an exception for your IP address.

If the block page shows a time, it's in UTC. Convert it to your local time before you search the events log.

Your host's firewall

Many hosts run their own firewall on the server, for example Imunify360, CSF or cPHulk in cPanel. It's separate from WordPress.

1. Look in your hosting panel for a firewall or blocked IP addresses page, and remove your address if it's listed.
2. If you find nothing, contact your host's support. Give them your IP address, the time and the URL you tried to open.

If you're blocked again

If you're blocked again right after the block is lifted, you're still doing something the firewall treats as an attack. Someone has to check the firewall log to find the rule that is triggered. If you don't have access to the Cloudflare account or the hosting panel, ask whoever does.