WHM

I locked WHM down to my admin IP, and the rule locked me out. Nothing was wrong with the rule. Cloudflare proxies the cPanel and WHM ports, so a request through an orange-cloud hostname reaches the origin from a Cloudflare address, the allow rule misses, and the drop rule fires. Here is why SSH keeps working and hides the problem, how to prove the path with read-only commands, the one fix that holds, and why allowing Cloudflare’s ranges is the fix you must never make.