Knowledgebase

Overview

To enhance server security and reduce unauthorized access attempts, you can block direct access to cPanel, WHM, and Webmail using Cloudflare Firewall Rules. This is especially useful if these services are exposed publicly or are being targeted by brute-force attacks.

This guide explains how to block requests that attempt to access the following paths:

• /cpanel

• /whm

• /webmail

Requirements

• An active Cloudflare account

• The domain must be proxied through Cloudflare (orange cloud enabled)

• Access to Cloudflare Firewall / WAF rules

Steps to Create the Firewall Rule

1. Log in to your Cloudflare Dashboard

2. Select the desired domain

3. Navigate to
   Security → WAF → Firewall Rules
   (or Security → Firewall Rules, depending on UI)

4. Click Create Rule

Firewall Rule Expression

Use the following expression to match and block cPanel-related endpoints:

(http.request.uri.path contains "/cpanel")
or (http.request.uri.path contains "/whm")
or (http.request.uri.path contains "/webmail")

Action

• Choose Action: Block
  (You may also use Managed Challenge or JS Challenge if you want softer enforcement)

Rule Name (Recommended)

Block cPanel, WHM & Webmail Access

Save & Deploy

Click Deploy or Save, and the rule will take effect immediately.

Verification

After enabling the rule:

• Visiting:

  • https://yourdomain.com/cpanel

  • https://yourdomain.com/whm

  • https://yourdomain.com/webmail

• Should return a Cloudflare block page (HTTP 403)

Optional Enhancements

Allow Specific IPs (Whitelist)

Create a higher-priority rule to allow trusted IPs before this block rule:

ip.src in {203.0.113.10 203.0.113.11}

Restrict by Country

Limit access only to specific countries:

(not ip.geoip.country in {"BD"})
and (http.request.uri.path contains "/cpanel"
or http.request.uri.path contains "/whm"
or http.request.uri.path contains "/webmail")

Apply Only to Subdomains

If cPanel is hosted on a specific hostname:

(http.host eq "server.example.com")
and (http.request.uri.path contains "/cpanel"
or http.request.uri.path contains "/whm"
or http.request.uri.path contains "/webmail")

Notes & Best Practices

• Cloudflare blocks only HTTP/HTTPS traffic — direct access via server IP will still work unless firewalled at OS or provider level

• Always keep SSH and control panel ports restricted at the server firewall (CSF/UFW/iptables)

• For maximum security, combine Cloudflare rules with server-side IP whitelisting

Conclusion

Blocking cPanel, WHM, and Webmail paths at the Cloudflare edge significantly reduces attack surface and prevents unauthorized access attempts before they reach your server.