https://kb.acenet.us/index.php?action=history&feed=atom&title=Secure_your_cPanel_serverSecure your cPanel server - Revision history2026-10-27T18:32:04ZRevision history for this page on the wikiMediaWiki 1.45.6https://kb.acenet.us/index.php?title=Secure_your_cPanel_server&diff=2945&oldid=prevDocs admin: Rewritten for current WHM and Acenet servers (WHM section refresh)2026-10-27T14:26:20Z<p>Rewritten for current WHM and Acenet servers (WHM section refresh)</p>
<p><b>New page</b></p><div>This checklist is for '''cloud servers and dedicated servers''' with cPanel, where you have root access. It covers the steps that prevent most security problems. If you're not sure whether we manage any of these for your server, please [[Open a support ticket|open a support ticket]].<br />
<br />
== Keep everything updated ==<br />
<br />
* '''cPanel:''' in WHM, go to '''Server Configuration''' > '''Update Preferences''' and keep automatic updates turned on.<br />
* '''Operating system:''' install updates regularly with <code>dnf update</code> (AlmaLinux and CloudLinux) or <code>apt update && apt upgrade</code> (Ubuntu). Restart the server after kernel updates, so the new kernel is used.<br />
* '''PHP:''' move your websites to a [https://www.php.net/supported-versions.php supported PHP version] in '''MultiPHP Manager''', and remove versions nobody uses in '''EasyApache 4'''.<br />
* '''Website software:''' update WordPress and other applications, with their plugins and themes, in every account.<br />
<br />
When your operating system version reaches end of life, it stops getting security updates. Plan a move to a newer server before then.<br />
<br />
== Run Security Advisor ==<br />
<br />
In WHM, go to '''Security Center''' > '''Security Advisor'''. It checks your server for common problems and explains how to fix each one. Run it after setting up the server, and again from time to time.<br />
<br />
== Protect your logins ==<br />
<br />
* '''Two-factor authentication:''' turn it on for root in '''Security Center''' > '''Two-Factor Authentication'''. Also turn it on for the Client Area. See [[Secure your Client Area account]].<br />
* '''SSH keys:''' log in to SSH with a key instead of a password. Add your key in '''Security Center''' > '''Manage root's SSH Keys''', test it, then turn off password logins in '''SSH Password Authorization Tweak'''.<br />
* '''Brute force protection:''' turn on '''cPHulk Brute Force Protection''' in '''Security Center''', and add your own fixed IP addresses to its whitelist. If your server runs Imunify360, it provides this protection instead.<br />
* Use a strong, unique root password and keep it in a password manager.<br />
<br />
Keep a way back in if something goes wrong. See [[Locked out of your server]].<br />
<br />
== Use a firewall ==<br />
<br />
Allow only the ports your server needs. cPanel lists them in [https://docs.cpanel.net/knowledge-base/general-systems-administration/how-to-configure-your-firewall-for-cpanel-services/ How to Configure Your Firewall for cPanel Services].<br />
<br />
== Scan for malware ==<br />
<br />
Install a malware scanner, such as ImunifyAV or Imunify360, or the ClamAV scanner from '''cPanel''' > '''Manage Plugins''' in WHM. Infected websites are the most common cause of spam, blacklisted IP addresses and slow servers.<br />
<br />
== Limit outgoing email ==<br />
<br />
Set an hourly email limit and turn on '''SMTP Restrictions''', so a hacked account can't send large amounts of spam. See [[Email sending limits and spam protection in WHM]].<br />
<br />
== Keep backups off the server ==<br />
<br />
In '''Backup''' > '''Backup Configuration''', turn on daily backups and send them to another server or storage service. A backup stored only on the same disk won't help if that disk fails. Test a restore now and then.<br />
<br />
[[Category:WHM]]</div>Docs admin