Running WordPress directly on cloud infrastructure like managed hosting platforms such as Cloudways, or on providers like Vultr or Amazon AWS, you may experience sudden spikes in server CPU usage or noticeably slower site performance due to a flood of malicious IPs or spam bots.
With Cloudways, you can easily identify IPs sending abnormally large numbers of requests from the application monitoring page, and instantly block those IPs via the server firewall. A whitelist to allow specific IPs is also available, and there is a country-based blocking feature that can block access from certain countries such as China or Hong Kong at the source.
This article explains how to block or allow specific IPs in the Cloudways firewall, and how to block an entire country.
How to block or allow a specific IP or block a specific country in the Cloudways server firewall
Earlier this year, a sudden surge of certain IPs and frequent visits from spam bots (commercial SEO bots) led to server CPU usage spiking near 100%.
When this happens, you might consider the following steps.
- Identify IPs that are coming in abnormally frequently and the spam bots.
- Block malicious IPs by integrating with Cloudflare.
- Add rules to robots.txt and the .htaccess file to block spam bots.
I blocked malicious IPs by integrating with Cloudflare and set a Managed Challenge for all countries except Korea and the United States to block bot access.
However, enabling Cloudflare caused site layout issues, likely due to caching problems, so I no longer use Cloudflare and instead block improper IPs through Cloudways' server firewall.
The free Cloudflare plan lacks a dedicated CDN edge location in Korea, which can introduce a slight delay for local users. Nevertheless, blocking bad IPs at the edge prevents traffic from reaching the server, delivering effective protection.
Next, we will look at how to block or allow specific IPs or block an entire country using the Cloudways server firewall.
Identifying frequently visited IPs
Identify frequently visiting IPs and determine which of them can be blocked safely.
In Cloudways, open My Applications, click an application to display its management page, and go to Monitoring » Analytics » Traffic » IP Requests.
The range can be set to 15 minutes, 30 minutes, 1 hour, or 1 day. By default, as shown above, you’ll see the list of IPs with the most activity in the last 15 minutes. For example, selecting 1 Day shows the IPs with the highest requests over the past day.
Details lets you check exactly which pages those IPs attempted to access.
As shown above, IPs attempting to reach /wp-login.php or repeatedly requesting XML-RPC related URLs are likely malicious.
If you’re unsure whether it’s safe to block a given IP, asking AI tools like Gemini or Perplexity can help. IPs related to search engines (Google, etc.) should be allowed, but others may be appropriate to block.
When I had Cloudflare linked, I had configured blocking for the IP shown above, and the logs at that time indicated the IP continued attempting to connect.
Blocking IPs or countries in the Cloudways server firewall
Between August and September 2024, during a month of large-scale DDoS attacks, I blocked the IPs used in the attack via Cloudflare. If you have IPs involved in a DDoS attack or other IPs that are consuming server traffic, you can block them through the Cloudways server firewall.
Additionally, if malicious IPs concentrate from certain countries (for example, China or Hong Kong), you can block the entire country.
Conversely, if legitimate users’ IPs are mistakenly blocked by the server firewall, you can add those IPs to a whitelist to allow access.
To add IPs to the firewall’s blacklist or whitelist, click the Servers node, select the server, and go to Security » Firewall.
If you see a screen like the one below, click Add Custom Rule.
Add Custom Rule pops up; use the IP Address tab to block or allow a specific IP address.
✅ You can either enter a specific IP like 123.456.789.12 directly, or specify a range with CIDR notation such as 123.456.789.0/24 to block or allow a whole range at once.
To block, check Black List, and to permit access, choose White List.
To block a particular country, click the Country tab and select the countries you want to block.
Monitoring after blocking IPs
Even after blocking, the monitoring page may still show those IPs for a while.
In reality, they are being blocked, so there’s no need to worry. As shown above, you may still see significant activity, but after consulting Cloudways support, they confirmed the IP is being blocked. Over time, it will naturally disappear from the Top 10 IP Addresses list.
When blocking an IP, carefully evaluate whether blocking it will have SEO implications. Blocking IPs needed by search engines or for service operations can lead to unexpected issues.
Conclusion
That's a wrap on how to block malicious IPs and specific countries using the Cloudways server firewall.
If your server CPU usage is spiking close to 100%, causing your site to slow down or your server to go down entirely, your first step should be to reach out to a Cloudways support representative via live chat to identify the root cause. Knowing exactly what's causing the issue is the key to finding the right solution.
In some cases, a specific WordPress plugin may be the culprit. Other times, the problem can stem from a flood of commercial spam bots (SEO bots), or from Googlebot and Bingbot crawling your site too aggressively.
While AI tools like ChatGPT or Gemini can be helpful resources these days, they can occasionally provide inaccurate information or suggest incorrect methods — so it's best to use them as a reference rather than taking everything they say at face value.
