How to Secure a cPanel Server: 15 Important Security Tips

A cPanel server may host websites, email accounts, databases, customer files, and other important data. If the server is not properly secured, unauthorized access, malware, brute-force attacks, or insecure settings can affect multiple websites and users.

Securing a cPanel server is not a one-time task. It requires regular updates, secure login settings, access controls, malware scanning, backups, and ongoing monitoring.

This guide explains 15 practical ways to improve cPanel and WHM security. Some steps can be completed from WHM, while others require root access and server-level knowledge. Before changing important server settings, create a backup and test the changes carefully.

The exact security settings may vary based on the operating system, cPanel version, server configuration, and applications running on the server.

Tips for Enhancing the Security of Your cPanel Server:

1. Securing SSH

Though SSH is an encrypted protocol, it is not impervious. Meaning that, as the administrator, you must exercise due diligence during configuration.Here are three simple steps to increase the security of your SSH.

I.Change SSH Port

Keeping SSH on the default port 22 makes it vulnerable to brute force attacks. To prevent these attacks, you should select a random port for SSH to make it more difficult for potential attackers to discern its location. Here are the steps to change the SSH port.

1. Log in to your server via SSH.
2. Edit the SSH configuration file, which is located at /etc/ssh/sshd_config, by issuing the following command:
   nano /etc/ssh/sshd_config
3. Set a random port for the SSH connection on the following line. Original: Port 22
   New line: Port 2468
4. Now, restart the SSH service by executing the following command:
   service sshd restart

II. Disable Root Login

To add a layer of security and further strengthen your SSH, you can disable the root user and create a separate user to access the server. Here is how:

1. Log in to your server via SSH. Before disabling root login, we will create a user to access the server:
   adduser new_username_name
   passwd new_username_name
2. You will be asked to set a password for this new user. Ensure that the password is as strong as possible (at least 10 characters with several numbers and symbols), then add the new user to the wheel group and grant it access to the server using the following line of code.
   # usermod -aG wheel new_username_name
3. Now, disable the root user. Edit the SSH configuration file, which is located at /etc/ssh/sshd_config.
   nano /etc/ssh/sshd_config
4. Change the line: “PermitRootLogin yes” to “PermitRootLogin no”
5. Now, restart the SSH service by executing the following command.
   service sshd restart

III. Disable SSH V1

With the advent of SSHv2, which has made its predecessor, SSHv1, all but obsolete, it is highly recommended that you disable the less secure and outdated SSH to improve your server’s security.

1. Log in to your server via SSH and edit the SSH configuration file, which is located at /etc/ssh/sshd_config.
2. Uncomment the following line.
   Protocol 2,1
3. And change it to:
   Protocol 2
4. Now, restart the SSH service by executing the following command:
   # service sshd restart

2. Enable cPHulk Brute Force Protection

cPHulk helps protect cPanel, WHM, and other supported services from repeated login attempts. It monitors failed logins and can temporarily block IP addresses or accounts when the configured limits are reached.

To review cPHulk settings:

1. Log in to WHM.
2. Go to the Security Center.
3. Open cPHulk Brute Force Protection.
4. Enable cPHulk if it is disabled.
5. Review the login failure limits and block duration.
6. Add trusted IP addresses only when necessary.

Be careful when adding IP addresses to the allow list. If your public IP address changes frequently, an incorrect configuration may cause access problems.

This helps limit repeated password-guessing attempts and reduces the risk of unauthorized access to cPanel and WHM accounts.

You can now set custom rules based on the cPanel username, IP address, and other parameters.

Once a set number of failed login attempts has been reached, cPHulk will block any further attempts from the IP address being used.

Note: If you have a static IP, then it is highly recommended that you add it to the Whitelist Management so that you do not lock yourself out of your server.

3. Use a Properly Configured Firewall

A firewall controls which network connections are allowed to reach the server. It can help block unwanted traffic and limit access to services that should not be publicly available.

Use a firewall that is supported by your operating system and cPanel environment. Review the following areas:

• Allow only the ports required by your websites and services.
• Restrict administrative services to trusted IP addresses when possible.
• Review firewall logs regularly.
• Remove rules that are no longer required.
• Test firewall changes before applying them to a production server.

Do not block ports without checking which services use them. Incorrect firewall rules can affect websites, email, DNS, SSH, or cPanel access.

A properly configured firewall can reduce unwanted network traffic and help prevent unauthorized access to server services.

4. Enable Malware Scanning

Malware scanning helps identify suspicious files, infected website content, and known malicious code. ClamAV can be used in supported cPanel environments, but the available options may depend on the server configuration and installed software.

After enabling a malware scanner:

• Run regular scans.
• Review scan results before deleting or quarantining files.
• Check affected websites for outdated plugins, themes, or applications.
• Update vulnerable software after removing malicious files.
• Keep a clean backup that can be used if recovery is required.

A malware scanner should be part of a wider security process. It should not be the only protection used on the server.

Regular malware scans can help identify suspicious files early and reduce the time needed to detect a compromised website or account.

5. Use Account Isolation on Shared cPanel Servers

If a cPanel server hosts multiple customer accounts, account isolation can reduce the impact of a compromised or resource-heavy account.

CloudLinux provides features such as CageFS and resource limits that can help separate users and control how much CPU, memory, and other resources each account can use.

Before using CloudLinux, confirm that it is supported by the server environment and that the required license is available.

Account isolation can help:

• Limit the effect of one account on other accounts.
• Reduce the risk of users accessing files that do not belong to them.
• Control excessive resource usage.
• Improve stability on multi-account servers.

Account isolation can reduce the impact of a compromised or resource-heavy account and help protect other users on the same server.

6. Keep cPanel, WHM, and the Operating System Updated

Security updates are one of the most important parts of server protection. Updates may fix vulnerabilities in cPanel, WHM, the operating system, web services, and other installed software.

Enable the appropriate update settings and review available updates regularly. Before installing major updates:

• Create or verify a recent backup.
• Check application compatibility.
• Review the update notes.
• Schedule maintenance if a restart may be required.
• Confirm that important services are working after the update.

Regular updates help close known security vulnerabilities and reduce the risk of attacks that target outdated software.

7. Restrict Access to WHM and Administrative Services

WHM provides high-level control over the server. Access should be limited to trusted administrators whenever possible.

Use WHM access controls to restrict administrative services by IP address when the administrator has a stable and trusted IP address.

Before applying restrictions:

• Confirm the correct public IP address.
• Add trusted access rules before restrictive rules.
• Keep an active administrative session open.
• Test access from an approved location.
• Document the rules for future administrators.

Do not use example IP addresses from this article in a live server configuration.

Restricting administrative access can reduce the number of systems that are allowed to reach sensitive server services.

To set up rules in Host Access Control, log in to your WHM and navigate to Security Center → Host Access Control.

The following is an example of locking down the SSH service:

Note: The rules have an order of precedence. You will have to put ‘allow’ rules before ‘deny’ rules if you are choosing to use the allow from a few, then deny from all technique.

8. Enable and Maintain ModSecurity

ModSecurity is a web application firewall that can help detect and block common attacks against websites.

In WHM, review the ModSecurity configuration and confirm that suitable rules are enabled. Keep the rule set updated and review alerts for false positives.

ModSecurity can help protect against attacks such as:

• SQL injection
• Cross-site scripting
• Malicious file uploads
• Known web application attack patterns
• Suspicious automated requests

Security rules should be tested carefully because strict rules may block legitimate website activity.

ModSecurity can add another layer of protection by identifying and blocking common web application attacks before they reach the website.

In the new window, it will display all the rules. You can click on Add Rule to create new rules. Please note that you will need to restart Apache to deploy new rules.

To know more about ModSecurity Tools, click here.

9. Run Regular Security and Malware Checks

Regular security and malware checks can help identify suspicious files, unexpected changes, insecure permissions, and possible signs of compromise.

Use supported security tools that are compatible with the operating system and cPanel environment. Review the scan results carefully instead of automatically deleting every file reported by a scanner.

You can review recent security activity by checking:

• System warning and error logs
• Failed SSH login attempts
• Unusual or resource-intensive processes
• Active network connections and services
• Recent changes to website and server files

These checks can help identify unusual activity and provide useful information during a security review. They do not replace a complete malware scan, but they can help you investigate potential security issues.

Check Recent Security Activity

Check recent system warning and error messages:

sudo journalctl -p warning..alert –since “24 hours ago”

Review recent failed SSH login attempts:

sudo grep “Failed password” /var/log/auth.log

For RHEL-based operating systems, such as AlmaLinux, Rocky Linux, or CloudLinux, use:

sudo grep “Failed password” /var/log/secure

Check processes using the most CPU resources:

ps aux –sort=-%cpu | head

Check active network connections and listening services:

sudo ss -tulpn

When a Security Alert Is Found

1. Confirm whether the file or activity is malicious.
2. Check which account or website is affected.
3. Review server and application logs.
4. Remove or isolate confirmed malicious files.
5. Update vulnerable software.
6. Change affected passwords.
7. Scan the server again.

Do not delete every file reported by a security scanner without reviewing it first. Some legitimate files may be flagged because of their code patterns or configuration. If you are unsure whether a file is safe to remove, contact your hosting provider or a qualified server administrator.

Regular security checks can help identify suspicious activity earlier and support faster investigation when a server may be compromised.

10. Scan cPanel Accounts for Malware

Malware can affect individual websites without immediately affecting the entire server. Regular account-level scans can help identify infected files and reduce the chance of malware spreading or remaining undetected.

When malware is found:

• Review the scan report.
• Confirm the affected account and files.
• Create a backup before making changes.
• Remove or isolate confirmed malicious files.
• Update the website software, plugins, themes, and scripts.
• Change passwords for affected accounts.
• Run another scan after cleanup.

Do not automatically remove every file detected by a scanner. Some results may require manual review.

Account-level scanning can help identify affected websites and make malware cleanup more focused and manageable.

11. Schedule Security Scans and Review Reports

Automatic scans can help detect suspicious files without requiring an administrator to start every scan manually.

Schedule scans during low-traffic periods when possible. The schedule should match the server size, number of accounts, and expected resource usage.

After scheduling scans:

• Confirm that the scan is running successfully.

• Send reports to a monitored email address.

• Review warnings and detected files.

• Check whether scans affect server performance.

• Update the scan schedule when the server workload changes.

Scheduled scans provide regular security checks and help administrators identify possible threats without relying only on manual reviews.

12. Limit Apache Version Information

Web server headers may reveal information about the server software. Limiting unnecessary version details can reduce the amount of information available to automated scanners and attackers.

In WHM, review the Apache settings and limit server signature information where appropriate.

This setting should be treated as an additional security measure. It does not replace software updates, access controls, or a firewall.

Limiting unnecessary server information can reduce the details exposed to automated scans and help support a layered security approach.

13. Limit PHP Version Information

PHP version information may be included in some server responses. Limiting this information can reduce unnecessary details exposed to visitors and automated scanners.

In WHM, review the PHP configuration and disable version exposure where appropriate.

Also, make sure that supported PHP versions are used. Hiding the PHP version does not protect an application that is running an outdated or vulnerable PHP release.

Limiting PHP version details reduces unnecessary information exposure, while keeping PHP updated helps protect against known vulnerabilities.

14. Use SFTP or Another Encrypted File Transfer Method

Traditional FTP can send usernames, passwords, and files without encryption. This can create a security risk when the connection is intercepted.

Use SFTP, or another supported encrypted file transfer method whenever possible.

Before disabling FTP completely, check whether any applications, backups, or customer workflows still depend on it.

Encrypted file transfers help protect login details and website files while they move between the user’s computer and the server.

15. Secure cPanel and WHM Login Access

cPanel and WHM provide access to important server and account settings. Protect these login pages with strong authentication and secure connections.

Review the following settings:

• Force secure HTTPS access.
• Use strong and unique passwords.
• Enable two-factor authentication for administrators.
• Remove unused accounts.
• Review user permissions regularly.
• Limit WHM access to trusted IP addresses when possible.
• Review login history and failed login attempts.
• Disable external authentication methods that are not required.

Do not disable a login method without confirming that administrators have another working way to access the server.

Strong login protection reduces the risk of unauthorized access and helps protect the server even if a password is exposed.

Disabling cPanel-ID Login

A cPanel server allows two types of logins.

The first is the default/standard username and password login and the second is to login to the server with a cPanel ID.

A cPanel ID allows users to deploy a single username and password to gain access to a wide variety of cPanel services.

While this method is more than suitable for organizations that manage a large data center and frequently hire new technicians, if you only have a single server, you should disable it by using the following steps.

1. Login to WHM and navigate to Home → Security Center → Manage External Authentication.
2. Change the cPanel-ID login to disable as shown in the below image.

What to Do If You Suspect a cPanel Server Has Been Compromised

If you notice unknown administrator accounts, unexpected file changes, unusual server activity, malware alerts, or unauthorized login attempts, investigate the issue immediately.

Follow these steps:

1. Limit access to the affected server if necessary.
2. Do not delete important evidence before reviewing it.
3. Check cPanel, WHM, SSH, web server, and system logs.
4. Identify affected accounts and websites.
5. Change passwords and review SSH keys.
6. Remove unauthorized users or access methods.
7. Scan the server and affected accounts.
8. Update cPanel, the operating system, and vulnerable applications.
9. Restore clean files from a verified backup if required.
10. Continue monitoring the server after cleanup.

For a serious security incident, contact the hosting provider or a qualified server-security professional.

This process can help contain the issue, identify affected services, and reduce the chance of the same problem happening again.

Conclusion

Securing a cPanel server requires more than enabling one security feature. A safer server uses several layers of protection, including regular updates, secure login settings, restricted access, firewall rules, malware scanning, backups, and ongoing monitoring.

Start with the most important steps: keep cPanel and the operating system updated, protect SSH and WHM access, enable brute-force protection, use a properly configured firewall, and review server activity regularly.

Before making major changes, create a backup and test the new settings. Security requirements can vary based on the operating system, cPanel version, hosted applications, and number of accounts.

Review the server security settings regularly. New vulnerabilities and security updates can change the actions required to keep a cPanel server protected.

Frequently Asked Questions

How do I secure a cPanel server?

Keep cPanel and the operating system updated, secure SSH access, enable cPHulk, use a properly configured firewall, enable ModSecurity, use strong authentication, and monitor the server regularly.

Is cPanel secure by default?

cPanel includes many security features, but server security also depends on the operating system, installed software, user access, configuration, and how regularly the server is updated and monitored.

Should I disable root SSH login?

Disabling direct root login can reduce the risk of unauthorized root access. Before making the change, create and test a separate administrative user with the required permissions.

Is changing the SSH port enough to secure SSH?

No. Changing the port may reduce some automated scans, but it does not replace SSH keys, strong authentication, software updates, and access restrictions.

How often should I update a cPanel server?

Review updates regularly and apply security updates as soon as practical. Test important changes and confirm that the server and hosted applications continue to work correctly.

Should I disable FTP?

Use SFTP or another encrypted method when possible. Before disabling FTP, check whether any applications or workflows still require it.

What should I do if malware is found?

Review the scan results, identify the affected account, create a backup, remove or isolate confirmed malicious files, update vulnerable software, change passwords, and scan the server again.