Your internet address is blocked — how to get back in

Suddenly nothing works. Your website does not load, your mail client keeps trying to connect, your FTP program gets no answer. And a colleague somewhere else has no trouble at all.

That is nearly always the same thing: the server has shut your internet address out for a while. This page explains why that happens, what you can do about it yourself, and why it will probably come back if you do not remove the cause.

Why a server shuts you out

Every server watches failed sign-in attempts. Five wrong passwords within ten minutes and the address they came from is ignored for an hour. That is not a punishment, it is the only defence that works against programs trying passwords day and night.

The awkward part is that the block stops all traffic from that address, not only the service that got the failed attempts. One phone with an old mail password can take a whole office off its own website, because from the outside all of that traffic comes from one address.

The attempts are rarely yours. In practice it is usually:

• a phone or tablet still holding the old mail password, retrying every few minutes;
• a mail client on a computer you hardly use, with the same problem;
• an old FTP program still asking for an account that was removed;
• a second person in the same office who remembered the password wrong.

First make sure it really is a block

A blocked address looks different from a broken website: the answer stays away instead of an error page arriving. You can check that on your own computer. On macOS and Linux this lives in Terminal; on Windows it works in PowerShell.

$ curl -sS --max-time 8 https://yourdomain.com
curl: (28) Connection timed out after 8001 milliseconds

$ curl -sS --max-time 8 -I https://ifconfig.co
HTTP/2 200

The first line runs into a timeout and the second one works: your internet is fine, but this server is ignoring you. Ask your phone for the same website on mobile data — if it loads there, it is certainly a block on your address and not a problem with your website.

Want to know which address it is about? curl -sS https://ifconfig.co says so. That same address is what the confirmation screen will name.

How to let yourself back in

The panel runs on a different machine from your website and your mail. That is why you can usually still reach the panel while everything else stays silent.

1. Go to /unblock on your panel's address — the same place you normally sign in, with /unblock after it.
2. Fill in the email address of your login. Not your website, not a mailbox address: the address you sign in to the panel with.
3. Press Send me a link. Give it a moment: your browser works out a small puzzle first, so automated programs cannot use this form thousands of times a minute.
4. You always get the same message back, even if the address is wrong. That is deliberate: otherwise anybody could try addresses to find out which ones have an account here.
5. Open the link from the message on the same internet connection. It only works from the address that is blocked, for fifteen minutes, and once.
6. The screen names the address that will be released. Press Lift the block and you are back in.

Stay on the same connection. Ask for the link at the office and open it on mobile data on the train, and the screen will say the address does not match. That is not a fault: it is exactly the check that stops somebody else using your link to unblock their own address. Just ask for a new link from the place where you are stuck.

What to do straight afterwards

Lifting a block fixes the address, not the cause. If an out-of-date password is still sitting somewhere, the next block will arrive within the hour.

• Go through your mail clients, phones and tablets included, and put the same current password everywhere.
• Check whether one of them still holds a mailbox you deleted.
• Lost your password? Set a new one in the panel first, and only then put it in your devices.

You may let yourself in three times a day. If you are hitting that limit something is structurally wrong, and your hosting provider is told about it — which is solved faster by looking at it together once than by unblocking a fourth time.

When this does not work

There are three situations in which the self-service cannot help you, and it is fairer to know that up front than to discover it by trying.

You cannot reach the panel either. Then the block is on the machine the panel runs on. Try from another connection — mobile data on your phone, for instance — or contact your hosting provider.

The screen says an administrator blocked this address deliberately. Then it is not an automatic block but somebody's decision, and only they can undo it.

Your hosting provider switched the self-service off. That is allowed per server, and the answer is to contact them: they can lift the block in one step.

What the screens deliberately do not say

Nowhere will you see which server you are on, which watcher set the block, or how many servers were asked. That is on purpose: which machine runs your website is nothing you need in order to do your work, and what you do not need does not belong on a screen anybody on the internet can open.

What you do see is your own internet address — on the request screen and on the confirmation screen. That is the one thing this whole journey is about.

Is this safe?

Yes, and it has been made deliberately more boring than it sounds. To lift a block, somebody has to be able to do three things at once:

1. read the mailbox of a login that exists here;
2. send traffic from the blocked address, because the link works nowhere else;
3. solve the puzzle that is paid before every request.

And even then the flow can do exactly one thing: release that one address, only on the servers your own hosting accounts live on, and only when the block came from an automatic watcher. It cannot block anything, and it does not touch a block an administrator set by hand.

Every lift goes into your hosting provider's security log, and you get a confirmation of it in your mail — so you notice if somebody else did it in your name.