How To Secure A cPanel WHM Server?

Updated: 28 September 2026 · Applies to: cPanel & WHM 138 on AlmaLinux, CloudLinux, Rocky Linux or Ubuntu (root access)

A new cPanel server is reasonably safe out of the box, but most break-ins still come through weak or reused passwords, outdated software and services left open that nobody uses. Work through this checklist after setting up a server, and again every few months. Every step uses tools that come with cPanel & WHM 138 or the operating system.

1. Keep cPanel & WHM up to date

1. In WHM, open Server Configuration › Update Preferences.
2. Choose the RELEASE or STABLE tier (or LTS to stay on one version), and keep Automatically apply security updates as soon as they are available ticked.
3. To update straight away, run /usr/local/cpanel/scripts/upcp as root.

2. Keep the operating system up to date

Apply operating system updates regularly: dnf upgrade on AlmaLinux, CloudLinux and Rocky Linux, or apt update && apt upgrade on Ubuntu. Reboot after a kernel update so the new kernel is actually running.

3. Run Security Advisor

Open Security Center › Security Advisor. It checks the server's configuration and lists problems by severity. Fix the red items first, then the yellow ones, and run it again after changes.

4. Protect the logins

• Two-factor authentication: turn it on in Security Center › Two-Factor Authentication for WHM, and ask resellers and cPanel users to enable it too.
• Strong passwords: set a minimum strength in Security Center › Password Strength Configuration.
• Brute-force protection: in Security Center › cPHulk Brute Force Protection, set cPHulk to On and add your own IP addresses to its whitelist first, as cPanel recommends, so you cannot lock out root.
• Limit access by IP address: if you always connect from known addresses, restrict SSH and WHM to them in Security Center › Host Access Control.

5. Secure SSH

1. Add your public SSH key for root in Security Center › Manage root's SSH Keys, and check that you can log in with the key.
2. In Security Center › SSH Password Authorization Tweak, disable password authentication. This applies to root too, so every user who needs SSH must have a key first.
3. Optionally, allow root to log in with a key only: set PermitRootLogin prohibit-password in /etc/ssh/sshd_config and restart SSH with systemctl restart sshd. Keep your current session open until a new login works.
4. Only users in the wheel group can switch to root. Review them in Security Center › Manage Wheel Group Users.

6. Run a firewall

AlmaLinux and Rocky Linux enable firewalld by default. Keep it with only the ports your services need, or replace it with CSF (ConfigServer Security & Firewall), which cPanel now maintains as the cpanel-csf package and which adds login-failure blocking. Step by step: Install CSF on cPanel Server.

7. Add a web application firewall

ModSecurity with the OWASP Core Rule Set blocks many common attacks on websites. In Software › EasyApache 4, install the ea-modsec2-rules-owasp-crs package (in Additional Packages), which cPanel updates regularly. The older "V3.0" rule set in Security Center › ModSecurity Vendors is no longer updated. Test your sites afterwards. If a rule blocks a legitimate request, find it in the Hits List in Security Center › ModSecurity Tools and ask us to add an exception; single vendor rules cannot be switched off there.

8. Use supported PHP versions and PHP-FPM

• In Software › MultiPHP Manager, move sites off end-of-life versions. PHP 8.1 no longer gets security fixes, PHP 8.2 gets them only until 31 December 2026, and PHP 8.3, 8.4 and 8.5 are supported. Check each site works on the new version before switching.
• Turn on PHP-FPM for your accounts in MultiPHP Manager. Each account's PHP then runs as that account's own user, so one hacked site cannot read another account's files.
• To stop PHP scripts running system commands, add functions such as exec, shell_exec, system, passthru, proc_open and popen to disable_functions in Software › MultiPHP INI Editor. Some applications need one of them, so test after changing it.

9. Limit shells and compilers

• Give cPanel users a Jailed Shell or Disabled Shell in WHM's Manage Shell Access interface (search for it in WHM).
• Enable Security Center › Shell Fork Bomb Protection.
• In Security Center › Compiler Access, disable compilers for unprivileged users, so attackers cannot build tools on the server.

10. Secure FTP, or turn it off

In Service Configuration › FTP Server Configuration, set Allow Anonymous Logins and Allow Anonymous Uploads to No, and set TLS Encryption Support to Required (Command/Data) so passwords are never sent in plain text. If everyone uses SFTP, turn FTP off in Service Configuration › Service Manager.

11. DNS: no open recursion

cPanel uses PowerDNS by default (Service Configuration › Nameserver Selection), which answers only for the domains on the server. If you switched to BIND, make sure /etc/named.conf contains recursion no; for outside clients, so the server cannot be used in DNS amplification attacks.

12. Scan for malware

cPanel › Manage Plugins in WHM lists the add-ons available for your server, including malware scanners. Schedule regular scans of the home directories, and ask us if you need help choosing or setting one up.

13. Harden the network settings

Create /etc/sysctl.d/90-hardening.conf with these lines, then apply them with sysctl --system:

net.ipv4.tcp_syncookies = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.all.log_martians = 1

Some container-based virtual servers do not allow these settings to be changed; on KVM VPS and dedicated servers they work normally.

14. Look for risky file permissions

List world-writable files, world-writable folders without the sticky bit, and files with no owner:

find / -xdev -type f -perm -0002 2>/dev/null > /root/world-writable-files.txt
find / -xdev -type d -perm -0002 ! -perm -1000 2>/dev/null > /root/world-writable-dirs.txt
find / -xdev \( -nouser -o -nogroup \) 2>/dev/null > /root/no-owner.txt

Review the lists before changing anything. Website files usually need 644 and folders 755; anything unexpected in a home directory can be a sign of a compromised site.

15. Keep backups off the server

Security also means being able to recover. In Backups › Backup Configuration, turn on backups and add a remote destination on the Additional Destinations tab, so a copy survives even if the server is lost. Test a restore now and then.

Need help hardening your server?

• cPanel server management: hardening, monitoring and one-time fixes, with no long-term contract.
• Managed cPanel VPS: cPanel & WHM included, with updates, security and monitoring handled by our team.
• Hire an Expert: pay only for the time used, from $8 per 15 minutes.