Updated: 28 September 2026 · Applies to: cPanel & WHM 138 on Amazon EC2 with AlmaLinux 9 or 10 or Ubuntu 24.04
You can run cPanel & WHM on an Amazon EC2 instance, but a few things work differently from a normal server: the instance sits behind 1:1 NAT, its public address must be made static, outgoing mail on port 25 is blocked by default, and cloud-init may reset the hostname. This guide covers those points. It replaces an older version written for CentOS 7 images.
1. Choose the instance
- Operating system: a fresh AlmaLinux 9 or 10 image or Ubuntu 24.04 LTS. Use the official images from AlmaLinux or Canonical rather than third-party templates, which cPanel warns may cause installation problems. cPanel installs only on a freshly installed system.
- Architecture: x86-64. cPanel does not support ARM, so Graviton instance types will not work.
- Size: cPanel needs at least 2 GB of RAM (4 GB recommended, and 3 GB or more if you use ClamAV) and at least 20 GB of disk (40 GB recommended). Give the root EBS volume enough room for all sites, mail and backups.
2. Give it a static public IP address
cPanel licenses only public, static IP addresses. The public address EC2 assigns at launch changes when you stop and start the instance, so allocate an Elastic IP and associate it with the instance before you install cPanel.
3. Open the ports in the security group
Allow at least: 22 (SSH, preferably only from your own address), 80 and 443 (websites), 2083 (cPanel), 2087 (WHM), 2096 (Webmail), 25, 465 and 587 (SMTP), 993 and 995 (IMAP and POP3 over TLS) and 53 TCP and UDP if the server runs DNS for your domains. Open more only when you use the service, for example 21 for FTP.
4. Set the hostname and keep it
The hostname must be a fully qualified domain name, such as server.example.com, that is not one of the websites on the server and that resolves to the Elastic IP. Create the DNS A record first, then set it:
hostnamectl set-hostname server.example.com
On EC2, cloud-init may set the hostname back at the next boot. Stop that by creating /etc/cloud/cloud.cfg.d/99-keep-hostname.cfg with:
preserve_hostname: true
5. Prepare the system as cPanel requires
On AlmaLinux, SELinux must be disabled: set SELINUX=disabled in /etc/selinux/config and reboot. cPanel also recommends turning off the system firewall before installing and setting up a firewall afterwards:
iptables-save > ~/firewall.rules systemctl disable --now firewalld.service # AlmaLinux systemctl disable --now ufw.service # Ubuntu
The security group still protects the instance in the meantime.
6. Install cPanel
cd /home && curl -o latest -L https://securedownloads.cpanel.net/latest && sh latest
The installation takes a while. When it finishes, open https://ELASTIC-IP:2087 and log in as root to complete the setup. A new installation can activate a 15-day trial license from a cPanel Store account; after that, the server needs a paid license for the Elastic IP.
7. Check the NAT setup
Inside the instance, the network card has a private address, and AWS maps it to the Elastic IP (1:1 NAT). cPanel supports this and detects it during installation; it keeps the mapping in /var/cpanel/cpnat. If you add or change an Elastic IP later, rebuild the mapping:
/usr/local/cpanel/scripts/build_cpnat
8. Outgoing mail
By default EC2 blocks outgoing traffic on port 25 to public addresses, so the server cannot deliver mail to other mail servers. Either ask AWS to remove the restriction and give the Elastic IP a reverse DNS name that matches the hostname, or send outgoing mail through an external SMTP relay on port 587.
Would a regular server be simpler?
A VPS or dedicated server with its own static IP needs none of the NAT, hostname or port 25 steps above. Ucartz sells cPanel licenses and offers cPanel server management if you want the installation and upkeep done for you.
Official documentation: cPanel installation guide, cPanel system requirements for AlmaLinux and Amazon EC2: restriction on port 25.
