An account is locked out.
FOR CPANEL OR FTP
Repeated failures block your IP address at the firewall, not just the account.
Test from mobile data. If it works there, you are blocked.
Open a ticket with your address from whatismyip.com.
FOR YOUR APPLICATION
A security plugin locking the account after failures. The lockout usually expires on its own.
To clear it immediately, disable the plugin by renaming its directory in File Manager.
IF IT WAS NOT YOU ATTEMPTING
Automated attacks against login pages are constant. A lockout notice usually means the protection worked.
Frequent notices mean the attacks are reaching your application and consuming resources.
REDUCING THEM
Protect the admin directory with cPanel Directory Privacy, so bots never reach the application Change the login URL where your platform allows it Use Cloudflare rules to challenge requests to login paths
Directory Privacy is the most effective on shared hosting, since it stops requests before your application runs.
THE RECURRING BLOCK
If your own address is blocked repeatedly, a device is retrying an old password. Find it.
