Safeguard Your Web Hosting Environment like a Pro
As a system administrator managing a cPanel server, security should be your top priority. cPanel provides a user-friendly interface for managing websites, but improper configurations or overlooked settings can expose your server to serious threats—ranging from malware injections to full server compromises.
This ultimate cPanel security checklist is designed to help sysadmins harden their servers, prevent attacks, and maintain a safe hosting environment.
1. Keep cPanel & System Software Up to Date
Enable automatic updates in WHM > Server Configuration > Update Preferences.
Regularly check for updates to:
cPanel/WHM
PHP versions
MySQL/MariaDB
Apache/Nginx
Use only stable versions unless testing is required in staging environments.
2. Enforce Strong Password Policies
WHM > Security Center > Password Strength Configuration
Set minimum password strength to 80+.
Encourage use of 2FA (Two-Factor Authentication).
Regularly reset and audit admin and user-level passwords.
3. Configure a Proper Firewall
Install and configure CSF (ConfigServer Security & Firewall):
Block unused ports (only keep 80, 443, 22, 2083, etc.).
Enable port flood protection, connection tracking, and login failure alerts.
Disable ping (ICMP) responses if not needed.
4. Secure SSH Access
Change the default SSH port from 22 to a custom number.
Disable root login via SSH:
Edit /etc/ssh/sshd_config:
PermitRootLogin no
Use key-based authentication instead of passwords.
Limit SSH access by IP if possible using /etc/hosts.allow and /etc/hosts.deny.
5. Enable and Configure ModSecurity
Go to WHM > Security Center > ModSecurity Configuration.
Use OWASP ModSecurity Core Rule Set (CRS).
Configure it to log, detect, and block common threats (XSS, SQL injection, etc.).
6. Activate CageFS or CloudLinux (If Available)
CloudLinux improves security by isolating users in virtualized environments.
With CageFS, each user account is sandboxed, limiting access to system files and preventing cross-account attacks.
7. Limit PHP Functions
WHM > MultiPHP INI Editor:
Disable dangerous functions:
Set appropriate open_basedir restrictions to prevent access to unauthorized directories.
8. Enable cPHulk Brute Force Protection
WHM > Security Center > cPHulk Brute Force Protection.
Protects SSH, WHM, cPanel, FTP, SMTP from brute-force attacks.
Set bans and notifications for repeated failed login attempts.
Enable country blocking if required.
9. Use Let’s Encrypt or AutoSSL
Ensure SSL is enabled for all domains.
WHM > SSL/TLS > Manage AutoSSL → Enable Let’s Encrypt.
Force HTTPS by redirecting all traffic using .htaccess or cPanel’s redirect tool.
10. Monitor Logs and File Changes
Regularly review:
/var/log/messages
/var/log/secure
/usr/local/cpanel/logs/access_log
/usr/local/cpanel/logs/error_log
Use rkhunter or chkrootkit for rootkit detection.
Use Linux Malware Detect (LMD) with ClamAV integration to scan files for malware.
11. Enable Two-Factor Authentication (2FA)
WHM > Security Center > Two-Factor Authentication.
Enforce for all cPanel and WHM users.
Users scan a QR code with Google Authenticator or similar apps.
12. Disable Unused Services
Disable services like FTP if SFTP is available.
Use WHM > Service Manager to disable unnecessary daemons.
Avoid running demo or testing software on production environments.
13. Limit Cron Job Abuse
Review user cron jobs regularly via:
Disable unused cron services and restrict execution frequency.
14. Restrict File Uploads and Permissions
Ensure users cannot upload .php, .exe, or dangerous scripts into /public_html/uploads or similar folders.
Set correct file permissions:
Files: 644
Directories: 755
No world-writable permissions.
15. Implement Backup Strategy
WHM > Backup Configuration:
Enable daily/weekly automatic backups.
Store backups offsite (e.g., Amazon S3, Google Drive, or remote FTP).
Regularly test restoration.
16. Monitor User Accounts and Disk Usage
WHM > List Accounts
Watch for:
Sudden storage spikes.
Suspicious domain names.
Multiple failed logins.
17. Protect DNS and Email Configurations
Use SPF, DKIM, and DMARC to secure outgoing email.
Regularly audit DNS entries for unexpected records or subdomains.
Ensure PTR (reverse DNS) is set for email IPs.
18. Enable HTTP/2 and Harden Apache/Nginx
Enable HTTP/2 for better security and performance.
Hide Apache version and OS info:
WHM > Service Configuration > Apache Configuration > Global Configuration:
19. Enforce File Integrity Monitoring
Install AIDE (Advanced Intrusion Detection Environment) to track changes to system files.
Run scheduled integrity checks and get alerts on unauthorized file modifications.
20. Stay Informed and Educated
Subscribe to security mailing lists (cPanel, Linux, CSF).
Monitor CVE feeds for vulnerabilities in your stack.
Stay updated with cPanel release notes and exploit databases.
cPanel servers host sensitive websites, email systems, and business apps—making them a prime target for attackers. This checklist, if followed diligently, can greatly reduce your server’s attack surface and keep user data safe.
Security is not a one-time setup—make it a routine practice to review, test, and enhance your server hardening procedures.