.png&w=3840&q=75)
Websites & Hosting4 min
How to Defend Against DDoS Attacks Using cPanel Rate Limiting
NS
NameSilo Staff9/10/2026
Share
To defend against layer-7 DDoS attacks on cPanel hosting, you combine cPanel's IP Blocker to manually ban confirmed attacker IPs with server-level rate limiting your host manages, since true Apache rate-limiting modules require server access individual hosting accounts don't have. Rate limiting throttles or bans IP addresses attempting to load your web pages unnaturally fast, preserving your server's CPU and bandwidth.
Layer 7 vs Layer 4: What Kind of Attack Is This?
Layer 4 (network) attacks flood raw bandwidth and connections, overwhelming infrastructure before requests reach your application. These need network-level mitigation upstream of your server.
Layer 7 (application) attacks look like real traffic: HTTP requests hitting your homepage hundreds of times per second, cheap to send but expensive to process. This is the scenario of hundreds of IPs refreshing a page 50 times a second, and it's what most small-to-medium attacks actually look like.
Why It Matters: Real Customers, Real 503 Errors
When CPU hits 100% from a Layer 7 flood, your server can't distinguish attacker traffic from legitimate visitors fast enough. Real customers browsing during the attack get 503 Service Unavailable errors right alongside the attackers, turning a targeted attack into a blanket outage for everyone.
What's Actually Available in cPanel
True automatic rate-limiting modules (mod_evasive, mod_qos, mod_ratelimit) must be compiled and installed at the server level, infrastructure your host manages directly, not something exposed inside an individual hosting account. Your account isn't defenseless, though. Three genuine options exist within that scope:
Server resource limits (passive, already active): Your hosting account runs inside an isolated LVE with a hard cap on concurrent Entry Processes. This doesn't stop an attack on your specific site, but it means a flood against your account can't consume resources belonging to other customers, and your account throttles into a 508 error rather than taking the whole server down.
WordPress-level security plugins (active, self-configurable): Plugins like Wordfence include genuine rate limiting for login brute-forcing and general scan/scrape traffic, installed entirely through the WordPress dashboard, no server access needed.
The caveat: this runs after PHP has already loaded WordPress, so each malicious request still costs real CPU before being blocked, unlike true server-level rejection. Under a large flood, plugin logging can even fill available disk space on lower-tier plans.
Also note: Wordfence's rate limiting defaults to unlimited and must be manually configured.
External edge protection (active, self-configurable): Routing your domain through Cloudflare's free tier filters malicious traffic before it reaches your server at all, and it's something you configure entirely on your own.
Manually Blocking Attacker IPs
- In cPanel, go to Metrics → Raw Access Logs and download the log during or right after the spike
- Identify IPs generating an abnormal volume of requests in a short window
- Go to Security → IP Blocker, enter each offending IP or CIDR range, and click Add
- If the attack is distributed across hundreds of rotating IPs, manual blocking won't keep pace, at that point, escalate to hosting support
Common Mistakes
Assuming .htaccess alone enables true rate limiting: Without an underlying module like mod_evasive already installed server-side, .htaccess has no rate-limiting directives to configure. It can block specific IPs, but can't throttle by request frequency on its own.
Setting manual IP blocks too broadly: Banning an entire range without confirming it's malicious risks blocking real customers browsing quickly during checkout.
The Real Ceiling: When You Need an Edge Layer
The three options above are genuinely effective against small-to-medium botnets. But surviving a massive, multi-gigabit volumetric attack requires traffic filtered before it reaches your server at all, which is what Cloudflare's edge network provides at scale. No single hosting account absorbs that scale of attack alone.
What This Means for You
NameSilo Hosting includes cPanel's IP Blocker and Raw Access Logs for manually blocking attacking IPs, with support available for larger, server-level incidents.
Frequently Asked Questions
What is rate limiting in cPanel?
Throttling or blocking IPs that send requests faster than a normal visitor would.
How do I stop a DDoS attack on my website?
Block attacker IPs manually, contact support, and use edge protection for large attacks.
Can .htaccess stop a DDoS attack?
It can block specific IPs but can't enable frequency-based limiting on its own.
How do I block multiple IPs in cPanel?
Security → IP Blocker, entering IPs or CIDR ranges individually or in bulk.
Why is my server CPU at 100%?
Likely a Layer 7 flood; check Raw Access Logs for abnormal request volume.
What is a Layer 7 DDoS attack?
An application-level flood of real-looking HTTP requests overwhelming your server.
Does NameSilo hosting include DDoS protection?
Standard infrastructure protections apply; IP Blocker gives manual customer-side control.
.png&w=2048&q=75)
NameSilo StaffThe NameSilo staff of writers worked together on this post. It was a combination of efforts from our passionate writers that produce content to educate and provide insights for all our readers.
More articleswritten by NameSilo
.png&w=3840&q=75)
.png&w=3840&q=75)