Your site is blocked in China for missing an ICP filing. Fix it in this order

The domain resolves. Ping works. You open it from your laptop in Singapore and the page loads fine. Then a colleague in Shanghai sends a screenshot of a page that says the site has not completed ICP filing, and you spend an afternoon convinced something is wrong with DNS.

Nothing is wrong with DNS. This is the access provider doing what the regulator requires it to do, and there is a specific order of operations that gets you out of it without wasting three weeks.

What the block actually is

Alibaba Cloud monitors which domains resolve to its mainland IP ranges. When a domain points at a mainland server and has no filing record attached, the system intercepts requests and serves a block page. Their own documentation states it plainly. A domain resolved to a mainland server without a filing gets identified and blocked, and the visitor sees a notice telling them to complete the filing.

Tencent Cloud and Huawei Cloud run the same check, because it is an obligation on the access provider, not a policy each company invented. Changing providers does not help. Moving to a smaller mainland host does not help either, and a host that offers to skip the check is offering to lose its licence.

Two details catch people who test from abroad. The block is applied at the mainland edge, so a request from outside China often still gets through, which makes the problem look intermittent. And if you use a CDN with mainland nodes, the CDN edge blocks before your origin server ever sees the request, so logs on the server look clean while users see nothing.

The thing nobody tells you before you start

This is the part that wrecks launch plans, and it is written in a help page most people read after the fact.

A site cannot be open to the public before the filing number is issued. Alibaba Cloud’s wording is that websites without a filing number are not permitted to open access, and any that do get identified and blocked by the monitoring system. The same rule applies to a first filing, to adding a new site and to a filing that has not yet been moved to a new provider.

Once a filing exists, ordinary changes behave better. Updating a contact person or a company detail does not take the site down. Removing a domain from a filing does, and it takes effect after the bureau approves the change. Cancelling a filing takes one to twenty working days and the site goes dark when it lands.

The workaround experienced teams use is to launch on a Hong Kong or Singapore node first, keep the mainland build behind a login or on a separate domain, then switch traffic to the mainland server the day the filing is approved. Users see one launch. The bureau sees a compliant site.

Three ways out, and the order to do them in

Doing these in the wrong order is how a two week problem becomes a two month one. The sequence is: stop the bleeding, then fix the cause.

Step one, restore access. Change the DNS record or migrate the instance to a non-mainland region. If you are on a CDN, remove or disable the mainland acceleration before you touch DNS, or the edge keeps serving the block page. This buys you time and costs you a day of work. Do it even if you plan to file, because the filing is going to keep the site closed anyway.

Step two, work out who can sponsor the filing. This is where foreign companies stall. The filing needs a mainland legal person as sponsor. If you have a mainland subsidiary, a branch or a representative office, use it. If you do not, you either create one or you use a provider’s entity under an agreement. There is no third structural option, whatever an agency tells you.

Step three, file, wait, then switch. A website filing runs about two weeks once the entity and the mainland server are ready, and an app filing about three. Provincial review controls the clock and no provider can compress it. When the number is issued, put it in your footer with a link to the MIIT lookup page, then move traffic back to the mainland node.

One trap in step two. If your servers sit under an Alibaba Cloud international account, you cannot file from that account at all. The international site explicitly does not support filing applications, and the sponsor has to be an entity registered in mainland China or a mainland resident. You need a China site account, which is a separate registration with separate verification. Teams lose a week discovering this.

What “foreign companies cannot get a filing” really means

The sentence is close enough to true that it circulates everywhere, including in cloud provider documentation. It is also imprecise in a way that costs people money.

What is true. A foreign-registered company cannot be the sponsor in its own name. Most provinces want a mainland business licence, and the few that accept an overseas entity want a mainland address down to the street number and a mainland contact person who answers the phone.

What is not true. There is no rule saying a foreign-owned business cannot operate a filed website in China. The route exists, it is just indirect. A representative office, a branch, a subsidiary or a provider entity each produce a filing that MIIT recognises. The cloud providers know this, which is why Alibaba Cloud sells a paid GoChina filing assistant to the same foreign customers its documentation tells to register a mainland entity first.

If you want the detail on those routes, two of our guides cover them. The one on filing without a WFOE walks through representative office, branch and hosted filing. The one on Hong Kong companies covers the notarisation requirements and the four documents Hong Kong applicants most often get wrong.

After the number arrives, one more filing

This step is missing from almost every English guide, and it is the one that produces actual penalties.

ICP filing is administered by the telecom regulator. A second filing is administered by the police. Under Article 12 of the Measures for the Security Protection of Computer Information Networks, any organisation using a network connected to the internet has to register with the local public security bureau within 30 days of the network going live. The form is filed at the national public security service platform, and it needs the business licence, the legal representative’s ID, a security officer’s ID, the domain certificate and an emergency contact.

Skip it and the penalty is not a warning letter. Article 23 sets a warning or suspension of operations for up to six months. Public security bureaus do check. In May 2026 the Ministry of Public Security’s cybersecurity bureau published a case from Taiyuan where three companies with valid ICP filings were administratively warned for missing the 30 day window.

For a foreign client this is usually invisible until someone asks. We file it as part of the service, because a client who has a filing number and no registration number is half compliant and does not know which half.

Three things not to do while blocked

Do not buy a filing number. Rentals and shared numbers exist in the market. When the regulator finds a filing whose sponsor has no relationship to the site, the filing is cancelled and the domain can end up on a list that makes the next application harder. You also have no recourse when the seller disappears.

Do not file under a friend’s company. Domain registrant names have to match the sponsor. That is checked at review, and it is checked again when the sponsor later tries to remove your domain. A filing you do not control can be cancelled by someone else in an afternoon.

Do not believe a three day promise. Provincial review has a statutory window of 20 working days. Pre-review by the access provider takes about one working day, and MIIT sends an SMS verification you have to complete within 24 hours or the application lapses. Nobody can shorten the bureau’s clock, and anyone who says they can is describing a filing that is already in someone else’s name.

Questions that come up when a site is already down

Is my domain damaged?

No. The domain is fine and the DNS is fine. What is blocked is the request path to a mainland IP without a filing behind it. Point the domain elsewhere and it works immediately.

Can I keep the site live on a Hong Kong server while the filing is reviewed?

Yes, on a different server and a different IP. What you cannot do is keep serving the mainland server while the application is under review, because the monitoring system will block it and a reviewer who checks will see a live site and reject the application.

Does the block hurt my search rankings?

Mainland traffic goes to zero, so Baidu indexing stalls and any indexed pages decay. Google and Bing are unaffected if the site is reachable from outside China, which it usually is.

How fast does traffic come back after approval?

Once the filing number is issued and the domain is pointed back at the mainland server, resolution and provider sync typically take a few hours to a day. Keep the old record until the new one is confirmed working.

Can I file from an Alibaba Cloud international account?

No. The international site does not accept filing applications. You need a China site account, and the sponsor has to be a mainland-registered entity or a mainland resident.

My app is blocked too. Is it the same filing?

No. App filing is a separate submission with its own materials, including the package name and the signing certificate signature. A website filing does not cover an app, and an app filing does not cover a website.