WHM Security Checklist for a New cPanel Server

Before the first website goes live on a new cPanel server, work through this WHM checklist: updates, SSH keys, Security Advisor, PHP-FPM, cPHulk, ModSecurity, compiler and SMTP restrictions.

M By Max October 30, 2026 · 7 min read

WHM Security Checklist for a New cPanel Server

A new cPanel & WHM server is not secure just because the installer finished. Before you host a single client site or mailbox, spend an hour in WHM's Security Center and a few related screens: confirm automatic security updates, move root to SSH keys, run Security Advisor, choose a per-user PHP handler such as PHP-FPM, turn on cPHulk, install the OWASP rules for ModSecurity, and restrict compilers, outbound SMTP and shell resources. Every item below is a real WHM interface documented by cPanel, so you can work through it in order.

Before you start: keep a way back in

Several of these steps change how you log in. A mistake can lock you out of your own server.

Confirm you have console access from your hosting provider or data center (a web console, KVM or IPMI). cPanel's firewall guide says plainly to always maintain console access.
Note the public IP addresses your team uses to administer the server. You will whitelist them in a few places.
Make changes one at a time and test a fresh login after each one, from a second browser session, before closing the first.

1. Updates first

An unpatched control panel is the easiest way in, so start here.

Pick a release tier

In WHM » Server Configuration » Update Preferences, choose a release tier. cPanel describes LTS as one version per year, STABLE as the most tested, RELEASE as the default for new installs, and EDGE as minimally tested and not recommended for production. For a business server, STABLE, RELEASE or LTS are the sensible choices; never EDGE.

Leave automatic security updates on

On the same page, keep "Automatically apply security updates as soon as they are available" selected. cPanel's documentation explains that security updates for your current major version are applied through an hourly job even if version updates are set to manual, and it recommends leaving this on.

Patch the operating system too

cPanel updates its own software, but the AlmaLinux, Rocky Linux, CloudLinux or Ubuntu packages underneath also need regular updates. Schedule them, and reboot when the kernel changes.

2. Run Security Advisor and read every alert

Open WHM » Security Center » Security Advisor. The scan runs automatically and color-codes its findings: red for severe issues, yellow for possible critical issues, blue for optional improvements and green for resolved items. Most alerts link straight to the WHM screen that fixes them.

Treat it as a to-do list, not a scorecard. Work through the red and yellow items, then click Scan Again to confirm. On some VPS platforms a few operating-system options are not available, so a remaining alert may simply not apply to your environment; write down why you accepted it.

A systems engineer reviewing server security settings

3. Lock down root and SSH

Use SSH keys instead of passwords

Create or import a key in WHM » Security Center » Manage root's SSH Keys and authorize it.
Log in with the key from a new terminal and confirm it works.
Only then open SSH Password Authorization Tweak and disable password authentication. cPanel notes that this setting also applies to root, so the key must be working first.

Limit who can become root

Direct root logins should be the exception. Create a regular administrative user and add it through Manage Wheel Group Users (on Ubuntu, Manage Sudo Group Users). cPanel warns to exercise extreme caution here, because wheel membership lets a user su to root. Once that path works, many administrators also set PermitRootLogin in /etc/ssh/sshd_config to prohibit-password or no; test carefully and keep the console handy.

Use API tokens for integrations

Scripts and billing systems should never store the root password. Create scoped tokens in WHM » Development » Manage API Tokens, grant only the privileges needed, set an expiration date and restrict the token to known IP addresses.

4. Turn on two-factor authentication and password rules

Two-Factor Authentication for WHM: enable the policy as root, then set up 2FA for root and resellers. cPanel users can then enable it in their own cPanel.
Password Strength Configuration: cPanel recommends a default required strength of 40 or higher on its 0–100 scale.
Configure Security Policies: enable Password Strength so the rule applies to existing accounts, not just new ones, and consider extending policies to API requests.

We cover these settings in depth in a separate guide on 2FA and password policies.

5. Choose a safe PHP handler

How PHP runs decides whether one hacked site can read another site's files. cPanel's PHP handler documentation notes that with DSO, scripts run as the nobody user unless extra modules are added, which makes it hard to tell which account a script belongs to, and DSO is not supported with PHP 8.0 and later. In MultiPHP Manager, enable PHP-FPM in the System Settings tab for new accounts and in User Domain Settings for existing domains, so each account's PHP runs in its own pool under that account's user.

While you are there, remove PHP versions that no longer receive security fixes from php.net, unless a legacy application truly needs one and you have extended support for it.

6. Protect logins and websites

cPHulk Brute Force Protection

Enable cPHulk in WHM » Security Center. It watches cPanel, WHM, mail, FTP and SSH logins and blocks addresses and accounts that fail too often. Add your own IP to the whitelist first; cPHulk shows a warning and an Add to Whitelist button if your current address is missing.

ModSecurity with the OWASP Core Rule Set

Install the ModSecurity Apache module through EasyApache 4, then add the OWASP Core Rule Set. cPanel's docs point to the ea-modsec2-rules-owasp-crs package as the current, regularly updated version; the older "V3.0" vendor entry is no longer updated. Review ModSecurity Tools » Hits List during the first weeks to catch false positives.

Firewall and AutoSSL

Open only the ports for services you actually use, following cPanel's firewall port table. Make sure Manage AutoSSL is enabled so every domain gets a valid certificate and renews it automatically.

7. Restrict what accounts can do

These Security Center switches are quick wins on any shared or multi-site server:

WHM interface	What it does	Recommendation
Shell Fork Bomb Protection	Applies `ulimit` limits to shell sessions, including a cap of 35 processes per user	Enable
Compiler Access	Restricts `gcc` to a `compiler` group instead of every user	Disable compilers unless an account needs them
SMTP Restrictions	Only the mail server, Mailman and root can connect to remote SMTP servers	Enable, so malicious scripts cannot bypass Exim
Apache mod_userdir Tweak	Controls access to sites via `http://hostname/~username` URLs	Restrict for most users, as cPanel recommends
Traceroute Enable/Disable	Changes the permissions on the traceroute binary; it starts disabled	Leave disabled unless you need it
Host Access Control	Allows or blocks access to services such as WHM and SSH by IP	Limit WHM and SSH to admin IPs where practical

Also give shell access only to accounts that need it. cPanel notes that users with a shell can bypass password-strength rules with the passwd command.

8. Backups and alerts before go-live

Configure Backup Configuration with at least one remote destination, and test a restore before you rely on it.
Set a monitored address in Basic WebHost Manager Setup and review Contact Manager so security notifications actually reach a person.
Consider Background Process Killer to stop IRC and packet-sniffing programs that are often abused, during the nightly update run.

A one-page checklist

Console access confirmed; admin IPs listed.
Release tier set; automatic security updates on; OS updates scheduled.
Security Advisor clean or exceptions documented.
Root uses SSH keys; password SSH disabled; wheel user created; API tokens scoped.
2FA policy on; password strength 40+ and enforced for existing accounts.
PHP-FPM for all accounts; unsupported PHP versions removed.
cPHulk on with your IP whitelisted; ModSecurity with OWASP CRS; firewall limited to needed ports; AutoSSL on.
Fork bomb protection, compiler restriction and SMTP restrictions enabled.
Remote backups configured and a test restore done; notifications reach a real inbox.

Get a second set of eyes

Hardening a server once is the easy part; keeping it that way as accounts, PHP versions and staff change is where most businesses slip. Max, our founder, is cPanel & WHM certified, and our team manages hosting servers for businesses across Miami-Dade and South Florida, with remote support nationwide. Request a free IT assessment and we will review your WHM configuration with you.