Imunify360 403 Forbidden / CAPTCHA - your access has been blocked

What’s actually happening

On a cPanel or shared-hosting site you suddenly get a 403 or a reCAPTCHA gate branded Imunify360. Solving the CAPTCHA may let you back in temporarily, or it may keep looping. Often it follows a few failed logins, an FTP/SMTP auth failure, or a request that matched a malware rule. The block is per-IP: the site loads fine from another network, and other visitors aren't affected. If your IP is on Imunify's RBL, you get a hard 403 with no CAPTCHA at all.

Common causes

• Brute-force protection greylisted your IP after repeated failed logins (wp-login, cPanel, FTP, mail, SSH)
• A request matched a ModSecurity/Imunify WAF rule — a malware signature, a suspicious query string, or a known-bad pattern
• Your IP is listed in Imunify360's RBL (Realtime Blackhole List); RBL hits are dropped at the WAF even if you're whitelisted locally
• Shared or VPN IP that another user got greylisted for, now applied to you
• CDN/proxy in front of the server hiding the real visitor IP, so Imunify greylists the wrong address or everyone behind it

How to fix it

1. If you're a visitor, solve the CAPTCHA once, then stop hammering the loginComplete the reCAPTCHA if shown and don't retry a bad password — more failures re-greylist you. If it loops or there's no CAPTCHA (a flat 403), your IP is likely RBL-listed and you'll need the host to act. Note your public IP first.
2. If you're the site owner, whitelist the IP from the Imunify panelIn cPanel, open Imunify360, go to the Incidents or Firewall/Greylist tab, find the IP, and add it to the White List. CLI equivalent: imunify360-agent ip-list local add --purpose white 1.2.3.4. This clears a local greylist immediately.
3. For RBL drops, whitelist AND understand the limitA local whitelist tells Imunify to ignore RBL for that IP on this server only — run imunify360-agent ip-list local add --purpose white <IP>, then check with imunify360-agent ip-list local list. It does not remove the IP from the global RBL, so the same IP can still be blocked on other servers until the global listing ages out.
4. Fix the real-IP detection if everyone is getting greylistedWhen a CDN (Cloudflare, etc.) fronts the server, configure Imunify360 + Apache/LiteSpeed to read the real client IP (mod_remoteip / X-Forwarded-For) so it greylists the actual offender instead of the proxy or all visitors. See Imunify's CDN-support docs.
5. Distinguish it from other host WAFs before troubleshootingImunify360 blocks are branded and tied to cPanel. A Sucuri block says "Access Denied - Sucuri Website Firewall," Wordfence is a WordPress-plugin block page, and a bare ModSecurity 406/403 has no branding. The unblock path is different for each.