How to change the number or failed logins for cPHulk to block an IP address.

Introduction

cPHulk allows you to protect your server from brute force attacks by blocking the offending IP addresses.  We can change how many failures are allowed before the IP address is blacklisted. 

Procedure

First, you will want to navigate to the cPHulk interface in WHM. (WHM >> Security Center >> cPHulk Brute Force Protection >> Configuration Settings)

You will see a few options on this list for changing the number of failed attempts.

Under "Username-based Protection", "IP Address-based Protection", and "One-day Blocks", you will be able to define the number of failures allowed for each of these categories respectively.  once done, just save at the bottom.  For more information regarding cPHulk and all of these configuration settings, please see the documentation here.

https://docs.cpanel.net/whm/security-center/cphulk-brute-force-protection/