Email Firewall Block: Too Many POP3 or IMAP Logins

If your IP was blocked by the server firewall with a message about POP3 or IMAP logins exceeding an hourly limit, your password is probably fine. This guide explains what that block actually means, how to get back online, and how to fix the mail client behavior that triggered it so it does not keep happening.

01. What the Block Message Actually Means

The notice you received looks something like this:

lfd - pop3d - 181 logins in 1369 secs from 203.0.113.45
for [email protected] exceeds 180/hour

There are two completely different firewall rules that can block a mail connection, and they mean opposite things:

If your message uses the second wording, you can stop worrying about your password. It is correct, it is current, and re-entering it will not help.

02. First, Get Yourself Unblocked

These blocks are temporary and expire on their own, usually within an hour. If you cannot wait, or if it has already expired and come back, you have three options:

1. Wait it out - the block lifts automatically once the timer runs down. If the underlying cause is still running, it will simply block again, so use the wait to work through the rest of this guide.
2. Unblock yourself - our firewall unblock page lets you clear your own IP without opening a ticket. See Firewall Block: How to Unblock Your IP for the walkthrough.
3. Open a ticket - if you have been blocked more than once, ask us to look at the mail logs. We can tell you exactly which program is looping and how much mail is sitting in the mailbox.

03. Why Your Mail Program Connects Hundreds of Times

Customers who get this block are usually surprised by the numbers, because their phone is set to check every 5 or 15 minutes. A phone on a 5-minute schedule connects about 12 times an hour. The blocks fire at 180 an hour, and the accounts that trip them are often running far above that.

Here is what is happening. POP3 was designed in an era when people downloaded their mail and deleted it from the server. Every time a POP3 client checks for new mail, the very first thing it does is ask the server for a complete list of every message currently in the inbox, including a unique ID for each one. It uses that list to work out which messages it has already seen.

That is fine with 200 messages in the inbox. It is a problem with 20,000.

Once a client falls into that loop it will not recover on its own. It retries forever, which is why the block comes straight back after it expires.

04. Check How Much Mail Is on the Server

Before changing any settings, find out what you are dealing with:

1. Log in to cPanel and open Email Accounts.
2. Find the address that appeared in the block message.
3. Look at the disk usage figure next to it.

Then check the message count. In webmail, open the inbox and look at the total shown at the bottom of the message list, or in your mail program look at the folder properties for the inbox.

Rough guidance on what you will find:

• Under 2,000 messages - not the cause. Skip to section 07, you likely have extra devices or an antivirus scanner involved.
• 2,000 to 10,000 messages - borderline. Many clients handle this, some do not. Switching to IMAP is still the right move.
• Over 10,000 messages - this is your cause. Both the protocol switch and a cleanup are needed.

05. The Real Fix: Switch From POP3 to IMAP

IMAP does not enumerate your whole mailbox on every check. It holds one connection open and the server tells it about new mail as it arrives. A mailbox size that breaks POP3 is a non-issue for IMAP.

The other benefits matter just as much if you use more than one device:

• Everything stays in sync - read a message on your phone and it shows as read on your desktop. Delete it in one place and it is gone everywhere.
• Folders work across devices - the folders you create are stored on the server, so every device sees the same filing.
• Sent mail is shared - replies sent from your phone appear in the Sent folder on your computer.
• Nothing is trapped on one machine - if a laptop dies, your mail is still on the server.

Settings to use

Incoming (IMAP)
  Server:    yourserver.ultrawebhosting.com
  Port:      993
  Security:  SSL/TLS
  Username:  full email address
  Password:  your email account password

Outgoing (SMTP)
  Server:    yourserver.ultrawebhosting.com
  Port:      465
  Security:  SSL/TLS
  Authentication: required, same username and password

Step-by-step instructions for each platform:

• How to Set Up Email in Microsoft Outlook
• How to Set Up Email on Your iPhone or iPad
• How to Set Up Email on Android
• POP3 vs IMAP - Choosing the Right Email Protocol

06. Archive or Clean Up Old Mail

Switching to IMAP stops the blocks. Trimming the mailbox makes everything faster and keeps your disk usage under control. An inbox with 20,000 messages is slow in any mail program, on any protocol.

You do not need to delete anything. Filing is enough:

1. Create folders by year in webmail or your IMAP client, such as Archive/2023 and Archive/2024.
2. Sort the inbox by date and move each year's mail into its folder. Work oldest first.
3. Leave the last 12 to 18 months in the inbox. Aim for under about 2,000 messages there.
4. Empty Trash and Junk once you are done. These are often larger than people expect.
5. Look for oversized attachments and save them to your computer, then delete the message. A handful of 30 MB messages can account for a large share of the total.

07. Extra Devices and Antivirus Scanners

If your mailbox is small and you are still getting blocked, the connection count is coming from somewhere else. Work through these:

Forgotten devices

Count every device and program that has ever had this address configured. Phone, tablet, work desktop, home laptop, an old machine in a spare room, a shared computer at the front desk. Each one connects on its own schedule, and they all share your office IP address as far as the firewall is concerned. Five devices checking every 2 minutes is 150 logins an hour before anyone touches anything.

Aggressive check intervals

In Outlook, go to Send / Receive > Send/Receive Groups > Define Send/Receive Groups and check the scheduled interval. Anything under 5 minutes is unnecessary and adds up quickly across devices. Multiple send/receive groups configured against the same account will multiply it further.

Antivirus mail scanning

Some security suites proxy your mail connections to scan messages, which can double every check or introduce its own retry behavior. If you have mail scanning enabled in your antivirus, disable that specific feature and see whether the login count drops. Your mail is already filtered on our side.

Duplicate accounts in one program

It is common to find the same address configured twice in a single mail program after a migration or repair, with both copies polling independently. Check the account list for duplicates.

08. When It Really Is a Password Problem

The tracking block is not a credential problem, but there are two situations worth ruling out.

You did change the password recently. If you updated the email password in cPanel and one device still has the old one saved, that device will produce failed logins and trip the other rule. The wording in the notice will say "failed" rather than "logins in X secs". Update the saved password on every device.

The connections are not coming from you. Look at the IP address and location in the block message. If it names a city, state, or country you have no connection to, treat that as a possible account compromise rather than a misbehaving client. In that case:

1. Change the email account password immediately in cPanel under Email Accounts, and use something long and unique.
2. Check for forwarders in cPanel under Email > Forwarders. Attackers commonly add a quiet copy-to address.
3. Check email filters for rules that auto-delete or redirect mail, which are used to hide activity.
4. Check the autoresponder for anything you did not set up.
5. Open a ticket so we can review the authentication logs and confirm what accessed the account.

Quick Recap: Fixing a Mail Login Block

If you only do five things from this guide, do these:

1. Read the log line, not the explanation - "X logins in Y secs" means successful logins, so your password is fine
2. Unblock your IP using our firewall unblock page, or wait for the block to expire on its own
3. Check your mailbox size in cPanel under Email Accounts - over 10,000 messages is almost certainly the cause
4. Switch every device from POP3 to IMAP on ports 993 and 465 with SSL/TLS, leaving none behind
5. Archive old mail into yearly folders so the inbox stays under about 2,000 messages

Last updated August 2026 · Browse all Email and Webmail articles