Secure your cPanel server

This checklist is for cloud servers and dedicated servers with cPanel, where you have root access. It covers the steps that prevent most security problems. If you're not sure whether we manage any of these for your server, please open a support ticket.

Keep everything updated

• cPanel: in WHM, go to Server Configuration > Update Preferences and keep automatic updates turned on.
• Operating system: install updates regularly with dnf update (AlmaLinux and CloudLinux) or apt update && apt upgrade (Ubuntu). Restart the server after kernel updates, so the new kernel is used.
• PHP: move your websites to a supported PHP version in MultiPHP Manager, and remove versions nobody uses in EasyApache 4.
• Website software: update WordPress and other applications, with their plugins and themes, in every account.

When your operating system version reaches end of life, it stops getting security updates. Plan a move to a newer server before then.

Run Security Advisor

In WHM, go to Security Center > Security Advisor. It checks your server for common problems and explains how to fix each one. Run it after setting up the server, and again from time to time.

Protect your logins

• Two-factor authentication: turn it on for root in Security Center > Two-Factor Authentication. Also turn it on for the Client Area. See Secure your Client Area account.
• SSH keys: log in to SSH with a key instead of a password. Add your key in Security Center > Manage root's SSH Keys, test it, then turn off password logins in SSH Password Authorization Tweak.
• Brute force protection: turn on cPHulk Brute Force Protection in Security Center, and add your own fixed IP addresses to its whitelist. If your server runs Imunify360, it provides this protection instead.
• Use a strong, unique root password and keep it in a password manager.

Keep a way back in if something goes wrong. See Locked out of your server.

Use a firewall

Allow only the ports your server needs. cPanel lists them in How to Configure Your Firewall for cPanel Services.

Scan for malware

Install a malware scanner, such as ImunifyAV or Imunify360, or the ClamAV scanner from cPanel > Manage Plugins in WHM. Infected websites are the most common cause of spam, blacklisted IP addresses and slow servers.

Limit outgoing email

Set an hourly email limit and turn on SMTP Restrictions, so a hacked account can't send large amounts of spam. See Email sending limits and spam protection in WHM.

Keep backups off the server

In Backup > Backup Configuration, turn on daily backups and send them to another server or storage service. A backup stored only on the same disk won't help if that disk fails. Test a restore now and then.