How to Block an IP Address on Apache and Nginx

Blocking an IP address can stop a specific source of abusive traffic from reaching your website. It is sometimes useful for repeated attacks, scraping, or persistent abuse, but it should be used carefully. ISPs, mobile carriers, offices, and VPN providers may share or rotate IP addresses, so a broad block can affect legitimate visitors too.

This guide shows current examples for Apache 2.4 and Nginx, including individual IPv4 addresses and CIDR ranges. The example addresses are reserved for documentation and must be replaced with the real address or network you intend to block.

Before blocking an IP address

• Confirm the address in your server or security logs before blocking it.
• Check whether the address belongs to a shared network, VPN, proxy, mobile carrier, or search crawler.
• Prefer rate limiting or a web application firewall when the problem is automated traffic rather than one persistent source.
• Use the narrowest possible rule. Blocking a single address is usually safer than blocking an entire network range.
• Make sure your server is seeing the visitor's real IP address if the site is behind a reverse proxy or CDN.

Block an IP address on Apache 2.4 using .htaccess

For current Apache 2.4 installations, use the Require directives. The older Order, Allow, and Deny syntax belongs to the compatibility module and is deprecated.

Add this to the .htaccess file in the directory you want to protect. This example blocks the documentation-only address 192.0.2.10:

<RequireAll>
    Require all granted
    Require not ip 192.0.2.10
</RequireAll>

Replace 192.0.2.10 with the actual IPv4 or IPv6 address. The rule applies to the directory containing this .htaccess file and its protected subdirectories, subject to your Apache configuration.

Block multiple IP addresses or a network range on Apache

Add another Require not ip line for each address or CIDR range. For example:

<RequireAll>
    Require all granted
    Require not ip 192.0.2.10
    Require not ip 198.51.100.25
    Require not ip 203.0.113.0/24
</RequireAll>

The sample ranges above are reserved for documentation. Use a valid network address and CIDR prefix for your actual block. Your host must allow the relevant authorization directives in .htaccess; otherwise, place the rule in the Apache virtual host configuration or ask your hosting provider.

Block an IP address on Nginx

Nginx does not use .htaccess. Add address rules to the appropriate server or location block in your Nginx configuration.

To block one address across the server block:

deny 192.0.2.10;

To block multiple addresses or an entire CIDR range:

deny 192.0.2.10;
deny 198.51.100.25;
deny 203.0.113.0/24;

Nginx checks access rules in order until a matching rule is found. If you already have allow or deny directives in the same configuration context, review their order and inheritance before adding another rule. The sample addresses are documentation examples, not real targets.

After editing the configuration, test it before reloading:

sudo nginx -t
sudo systemctl reload nginx

If the configuration test fails, correct the error before reloading. Use the server configuration rather than trying to add these directives to a WordPress or .htaccess file.

Important when using Cloudflare or another reverse proxy

If your website is behind Cloudflare, a load balancer, or another reverse proxy, the web server may see the proxy's IP address instead of the original visitor. Blocking the address shown in a log may then block the proxy and affect many visitors.

Configure the server's trusted-proxy or real-IP feature using only the official IP ranges of the proxy you actually use. Do not blindly trust a visitor-supplied X-Forwarded-For header. Once the server is correctly identifying the client address, apply the block to that address.

When an IP block is not the best solution

If the traffic comes from a changing pool of bots, a single IP block may have little effect. Consider rate limiting, a managed firewall, bot protection, or application-level controls. Blocking a large ISP or hosting-provider range can also prevent unrelated users from reaching your site.

Review and remove old blocks

Keep a record of why an address was blocked and review the rule periodically. Remove blocks that are no longer needed, especially when they cover a shared network or a range of addresses.

For the current Apache syntax, see the official Apache 2.4 access control guide. For Nginx, see the official access module documentation.