View Categories

Plesk Admin Login Blocked – IP Restriction Recovery Guide

🛠️ Plesk Admin Login Blocked – IP Restriction Recovery Guide

❗ Problem

You see this error when trying to log in to Plesk:

Access for administrator from address your IP address is restricted in accordance with IP Access restriction policy currently applied.

This happens when your current IP address isn’t allowed under Plesk’s administrative access restriction policy.

🧠 Background

Plesk allows administrators to restrict access to the control panel based on IP addresses. This is controlled via:

Tools & Settings → Restrict Administrative Access

If your IP is not on the allowlist, you’ll be blocked from logging in.

✅ Solution Options

🔁 Option 1: Add Your IP Address to the Allowlist (Recommended)

👨‍💻 Purpose:

Grant access only to your current IP while keeping existing restrictions intact.

🐧 On Linux (via SSH) 

plesk db "INSERT INTO cp_access (type, netaddr, netmask) VALUES ('deny', 'your.ip.address.here', '255.255.255.255')"

Explanation:

  • plesk db – This command allows running SQL queries directly on the Plesk internal database.
  • INSERT INTO cp_access – Adds a new rule to the IP restriction table.
  • type = 'deny' – In Plesk logic, 'deny' means allowed if policy is “deny unlisted”.
  • netaddr – Replace 'your.ip.address.here' with your real IP (e.g., 192.168.1.100).
  • netmask = '255.255.255.255' – Applies this rule to exactly one IP address (a single host).

🪟 On Windows (via RDP + Command Prompt) 

plesk db "INSERT INTO cp_access (type, netaddr, netmask) VALUES ('deny', 'your.ip.address.here', '255.255.255.255')"

This is the same command, just run in the Command Prompt (as Administrator) on a Windows-based Plesk server.

🧹 Option 2: Disable the IP Restriction Policy (Emergency Only)

👨‍🔧 Purpose:

Fully remove the access policy to allow all IPs. Use only if Option 1 is not feasible.

🐧 On Linux 

plesk db dump > plesk-backup.sql

Explanation:
Creates a backup of the Plesk database in case you need to restore the configuration.

plesk db "DELETE FROM cp_access"

Explanation:
Deletes all records from the IP restriction table (removing all IP rules).

plesk db "UPDATE misc SET val='allow' WHERE param='access_policy'"

Explanation:
Changes the policy setting from deny to allow, so Plesk will permit access from any IP.

systemctl restart psa sw-cp-server

Explanation:
Restarts the Plesk control panel web server to apply changes.

🪟 On Windows 

plesk db dump > plesk-backup.sql

Creates a database backup

plesk db "DELETE FROM cp_access"

Removes all IP restriction entries

plesk db "UPDATE misc SET val='allow' WHERE param='access_policy'"

Changes policy to allow unrestricted access

net stop PleskService && net start PleskService

Restarts the Plesk service to apply the new settings

🔒 After Regaining Access – Secure the Panel

Once you can log back into Plesk, it’s critical to reconfigure access restrictions properly.

🔧 GUI Steps: 

graph TD
  A[Tools & Settings] --> B[Restrict Administrative Access]
  B --> C[Set Policy: Deny Unlisted IPs]
  B --> D[Add Your IP + Office IP + VPN IP]

Explanation:

  • Go to Tools & Settings → Restrict Administrative Access
  • Set the policy to “Deny access to the server from all IP addresses except those listed”
  • Add multiple IPs: your home, office, VPN, etc. to avoid future lockouts

🔐 Enable Two-Factor Authentication

  1. Go to Security → Two-Factor Authentication
  2. Scan the QR code with an app like Google Authenticator or Authy
  3. Test login from multiple devices

✅ Recovery Checklist

✅ Task
⬜ Logged in successfully
⬜ Added your current and backup IPs
⬜ Access policy set to Deny Unlisted
⬜ 2FA enabled for all admin users
⬜ Database backup (plesk-backup.sql) stored safely
⬜ Logged incident in IT change history

💡 Best Practices

  • Always whitelist at least 2 IPs (e.g. home + VPN)
  • Keep regular backups of the Plesk DB
  • Test fallback IPs every quarter
  • Document changes in an IT admin logbook