50
cPanel is one of the most widely used web hosting control panels, providing a convenient interface for managing websites, domains, databases, email accounts, backups, files, and other hosting resources. Because so many critical functions are accessible from one place, cPanel security plays an important role in protecting both your websites and the underlying hosting environment.
Whether you manage a single website or multiple websites, a compromised cPanel account can expose sensitive data, website files, databases, email accounts, and configuration settings. Weak passwords, insecure connections, outdated software, and insufficient access controls can all increase the risk of unauthorized access and common web hosting attacks.
Improving cPanel hosting security therefore requires a layered approach. It starts with securing access to the control panel and continues with strong authentication, regular updates, proper account permissions, backups, malware protection, and secure server configuration.
Below are some of the most important cPanel security best practices for 2026 that can help reduce risk and strengthen the security of your hosting environment. Some of these measures apply to any cPanel account, while others (such as firewall rules, cPHulk, Security Advisor, SSH hardening, and server-wide updates) require WHM or root access and are aimed at administrators managing the whole server. Apply the ones that match your level of access.
1. Always Use HTTPS to Access cPanel
Why HTTPS matters
If you access cPanel over an unsecured HTTP connection, login credentials and other information can potentially be exposed, especially when using public Wi-Fi, shared networks, or compromised network environments. Using HTTPS significantly reduces this risk by encrypting the communication between your device and the server.
Certificate warnings should never simply be ignored. They may indicate an expired certificate, incorrect configuration, or a potentially unsafe connection.
Best practice
Before entering your cPanel credentials:
- make sure the login page uses HTTPS;
- verify that the browser does not display any certificate warnings;
- confirm that the server has a valid SSL/TLS certificate;
- avoid logging in through untrusted or unsecured networks whenever possible.
For administrators and website owners, encrypted access should be considered a basic requirement for every cPanel session.
2. Enable Two-Factor Authentication (2FA)
A strong password is essential, but passwords alone are not always enough to protect a cPanel account.
Enabling Two-Factor Authentication (2FA) adds an additional verification step to the login process. In addition to entering a username and password, the user must provide a temporary authentication code, typically generated by an authenticator application. This means that even if an attacker manages to obtain your password, they still need access to the second authentication factor before they can log in.
Why 2FA matters
Two-factor authentication helps reduce the risk of:
- unauthorized access caused by stolen passwords;
- credential-stuffing attacks;
- password reuse across different services;
- compromised login credentials;
- certain types of phishing attacks.
For administrators managing multiple websites or business-critical hosting environments, 2FA should be treated as a standard security measure rather than an optional feature.
Best practice
Enable 2FA for all accounts that have access to important hosting functions, especially administrator-level accounts. Whenever possible, use a trusted authenticator application to generate one-time verification codes.
Combining HTTPS access, strong and unique passwords, and two-factor authentication creates a much stronger first line of defense against unauthorized cPanel access.
3. Enforce Strong, Unique Passwords
Use a strong and unique cPanel password
A secure password should be:
-
unique to your cPanel account;
-
longer rather than just "more complex";
-
not based on names, company names, domains, or common phrases;
-
not reused across email, FTP, WordPress, SSH, or other services.
If an attacker finds your password in a breach or phishing incident, they often test the same credentials across other platforms immediately.
On cPanel & WHM servers, administrators can also set a minimum required password strength for all account types in WHM → Security Center → Password Strength Configuration.
Use a password manager
A password manager is usually the safest way to generate and store unique credentials. Avoid saving hosting passwords in the browser: credential-stealing malware targets browser password stores first, because they can be decrypted without a master password on a compromised machine. A dedicated password manager with a separate master password and automatic locking keeps cPanel credentials out of that attack path.
Avoid sharing the main cPanel password
If multiple people need access, avoid giving everyone one master password. Instead, create separate accounts for roles such as:
-
FTP/SFTP
-
email
-
database access
-
application access
-
SSH access
This makes it easier to revoke access and reduces damage if one credential is compromised.
4. Secure Your Server Beyond cPanel
cPanel security is not only about the control panel itself. You also need to harden the underlying server and reduce the number of ways attackers can gain entry. Beyond the authentication measures already covered above, apply the following:
-
Limit access to administrative accounts. Give users only the permissions they actually need. Developers, contractors, and employees should not receive full administrative access unless it is required for their work.
-
Secure SSH access. If SSH is enabled, use SSH keys instead of password authentication where possible. It is also common to disable direct root login and restrict access with AllowUsers or by IP address. Changing the default SSH port can reduce automated scanning and log noise, but it should not be treated as a substitute for proper authentication and access controls. Disable unnecessary shell access and restrict administrative connections to trusted users.
-
Protect login credentials. Never share passwords through unsecured messages, documents, or spreadsheets. Be especially careful with phishing emails and fake cPanel login pages designed to steal credentials.
-
Remove unused accounts. Regularly review cPanel, FTP, SSH, database, and email accounts. Delete credentials that are no longer required to reduce the number of potential entry points.
-
Monitor login activity. Watch for repeated failed login attempts, unfamiliar IP addresses, or unexpected account activity. Unusual login patterns may indicate brute-force attacks or compromised credentials.
-
Centralize security monitoring for multiple servers. If you manage more than one server, an open-source SIEM such as Wazuh collects logs, failed login attempts, and file integrity alerts from all machines in a single dashboard. This makes brute-force attempts and suspicious changes visible across the whole fleet instead of requiring manual checks on each server.
5. Set Up a Firewall and Restrict Open Ports
5. Set Up a Firewall and Restrict Open Ports
A firewall helps control which network services are accessible from the internet. Every open port increases the server's attack surface, so only services that are actually required should remain publicly available.
Review the ports used by:
-
cPanel and WHM
-
Web traffic
-
SSH
-
FTP
-
Email
-
DNS
-
Databases
Unused ports and unnecessary services should be restricted or disabled. For administrative services, restrict access to trusted IP addresses or a VPN where practical. WHM access, in particular, should be limited whenever possible. If cPanel or Webmail must be available to customers over the internet, protect them with HTTPS, strong authentication, 2FA, and brute-force protection rather than blocking the service entirely.
On cPanel & WHM servers, ConfigServer Security & Firewall (CSF) has long been a popular choice. Note that its original developer ceased operations in August 2025; cPanel now maintains a fork for cPanel users, so if you rely on CSF, keep it updated from the current supported source.
A properly configured firewall helps prevent unauthorized connections before they reach the application or login level.
6. Enable Brute-Force Protection with cPHulk
Brute-force attacks use automated scripts to try large numbers of username and password combinations until a valid login is found. On cPanel & WHM servers, start with the built-in cPHulk Brute Force Protection. Additional tools such as Fail2ban may also be used where appropriate, though their setup depends on the system and configuration.
cPHulk is integrated into cPanel & WHM and can protect services such as:
-
cPanel
-
WHM
-
SSH
-
FTP
-
Email authentication
Fail2ban can also be used to monitor logs and create blocking rules based on suspicious login activity. To avoid conflicts, do not run cPHulk and Fail2ban against the same services at the same time; choose one per service.
Anti-brute-force protection should be used together with strong passwords and 2FA rather than as a replacement for them.
7. Run Antivirus Tools Such as ClamAV
Malware can enter a hosting environment through vulnerable websites, compromised credentials, malicious uploads, or outdated applications. Running antivirus tools such as ClamAV can help detect suspicious files and known malware signatures. On cPanel servers, solutions like ImunifyAV or Imunify360 are also widely used, since they integrate closely with cPanel and can add active malware detection and quarantine.
Regular scans are particularly useful for servers hosting:
-
WordPress websites
-
File upload functionality
-
Email services
-
Multiple customer websites
-
Shared hosting accounts
Antivirus scanning should be treated as one security layer rather than a complete protection strategy. If malware is discovered, administrators should also investigate how it entered the server and close the original vulnerability.
8. Keep Applications Like WordPress Up to Date
Even a well-secured cPanel server can be compromised through an outdated web application. WordPress, plugins, themes, and other CMS software should be updated regularly because security vulnerabilities are frequently discovered in third-party components.
Keep the following up to date:
-
WordPress core
-
Plugins
-
Themes
-
PHP versions
-
CMS extensions
-
E-commerce modules
Remove plugins, themes, and applications that are no longer used. Outdated software increases the risk that attackers can exploit known vulnerabilities, upload malicious files, or gain unauthorized access to the website.
Keeping applications updated is one of the simplest and most effective ways to strengthen overall cPanel hosting security.
9. Use Built-In cPanel Security Tools
cPanel includes several built-in security features that can help protect websites, accounts, and server resources. Three useful tools are ModSecurity, Hotlink Protection, and Leech Protection. Each addresses a different type of risk and can be used as part of a broader cPanel security strategy.
ModSecurity
ModSecurity is a web application firewall (WAF) that helps protect websites from malicious HTTP requests and common web-based attacks. It analyzes incoming traffic and can block suspicious requests before they reach the website or application.
ModSecurity can help reduce the risk of attacks such as:
-
SQL injection
-
Cross-site scripting (XSS)
-
Malicious file requests
-
Exploit attempts
-
Suspicious automated traffic
In cPanel, ModSecurity can usually be managed on a per-domain basis, depending on the hosting provider's configuration. For websites running WordPress, Joomla, Drupal, e-commerce platforms, or custom web applications, enabling ModSecurity adds an important additional layer of protection.
Some security rules may occasionally block legitimate application requests. If this happens, administrators should review the relevant rule rather than disabling ModSecurity completely.
Hotlink Protection
Hotlink Protection prevents other websites from directly using files hosted on your server. It is primarily a bandwidth and resource protection feature rather than a core security control, but it helps stop unwanted use of your hosted files. For example, another website could embed an image using the URL from your domain instead of uploading the image to its own server. Every time that page is viewed, your server delivers the file and uses your bandwidth.
Hotlink Protection can help prevent unauthorized use of resources such as:
- Images
- Videos
- Downloadable files
- Media assets
This is especially useful for websites with a large amount of visual or downloadable content. By restricting which domains are allowed to access specific files, Hotlink Protection can help reduce unnecessary bandwidth consumption and prevent third-party websites from using your hosted resources without permission.
Leech Protection
Leech Protection helps prevent users from sharing credentials for password-protected directories. For example, if a restricted area of a website requires a username and password, one user could share those credentials with many other people, resulting in excessive logins from the same account.
Leech Protection applies specifically to password-protected directories. It monitors how many times an account logs in within a two-hour period and can take action when that limit is exceeded. Depending on the settings, cPanel can:
- Restrict the affected account
- Redirect users to another page
- Send an email notification to the administrator
- Disable access when suspicious activity is detected
This feature is useful for private website sections, membership areas, internal resources, and other password-protected directories. Note that Leech Protection may have limitations on servers running the LiteSpeed web server, so check your provider's configuration.
Together, ModSecurity, Hotlink Protection, and Leech Protection help protect different parts of a cPanel hosting environment: web applications, bandwidth resources, and restricted-access areas.
10. Use cPanel Security Advisor to Identify Risky Configurations
cPanel & WHM includes Security Advisor, a built-in tool that helps administrators identify potentially risky server configurations and improve overall server security. It scans the cPanel & WHM environment, groups findings by severity, and provides recommendations for fixing common security issues.
Security Advisor can help detect problems related to:
- Brute-force protection
- Authentication settings
- Service configuration
- Operating system security
- Software updates
- Firewall and network settings
- SSL/TLS configuration
- Other server-level security risks
You can access it in WHM → Security Center → Security Advisor. After making changes, run the scan again to confirm that the issue has been resolved.
Regular checks are especially useful after:
-
Setting up a new cPanel server
-
Installing or updating cPanel & WHM
-
Changing firewall rules
-
Adding new services
-
Modifying authentication or security settings
-
Migrating websites or accounts
Security Advisor is not a replacement for a full security audit, but it provides a practical way to detect risky configurations early and keep your cPanel server aligned with recommended security practices.
11. Schedule Automatic Updates in cPanel & WHM
Keeping cPanel & WHM and the underlying server software up to date is one of the most important parts of maintaining a secure hosting environment.
The importance of prompt patching was underscored in 2026 by CVE-2026-41940, a critical authentication-bypass vulnerability in cPanel & WHM (CVSS 9.8) that let unauthenticated attackers gain administrative access. Updating to a patched release was the primary and recommended way to fully address the vulnerability. Restricting administrative service ports could reduce exposure as a temporary mitigation, but it did not replace applying the security update.
You can review these settings in WHM → Server Configuration → Update Preferences, which controls how cPanel & WHM updates are handled.
Operating system and other server software updates may be managed separately, depending on the operating system, its package manager, and the server configuration.
Automatic cPanel & WHM updates help reduce the risk of running outdated control-panel software with known vulnerabilities. Other components should also be kept current, though they are often updated through the operating system's package manager or their own mechanisms rather than through WHM Update Preferences:
-
Operating system packages
-
Web server components
-
PHP packages
-
Mail services
-
Database software
For production servers, update settings should be configured carefully. Critical security updates should be applied promptly, while major version changes may require additional testing to avoid compatibility issues with websites, applications, or custom server configurations.
It is also good practice to:
-
Review update logs regularly
-
Monitor for failed updates
-
Check application compatibility after major upgrades
-
Create backups before significant system changes
-
Keep WordPress, plugins, themes, and other hosted applications updated separately
Scheduling and automating updates helps ensure that important security fixes are not missed and reduces the amount of manual maintenance required to keep a cPanel server secure.
cPanel Security Checklist
Before considering a cPanel environment properly protected, verify the following:
-
Use a strong, unique cPanel password
-
Enable two-factor authentication
-
Access cPanel only through HTTPS
-
Keep cPanel & WHM updated
-
Keep the server operating system updated
-
Enable brute-force protection
-
Run WHM Security Advisor
-
Limit administrative privileges
-
Secure or disable unnecessary SSH access
-
Install SSL certificates for websites
-
Keep CMS software, plugins, and themes updated
-
Review file permissions
-
Separate database credentials
-
Monitor websites for malware
-
Configure a firewall
-
Secure email accounts
-
Protect API tokens
-
Configure automated backups
-
Store backups outside the production server
-
Test restores regularly
-
Monitor login and server activity
-
Remove unused users and software
Final Thoughts: How to Improve cPanel Security
There is no single setting that makes a cPanel account completely secure. Effective cPanel hosting security comes from combining multiple protections.
Start by securing access with a unique password and two-factor authentication. Then protect communications with HTTPS, keep cPanel and hosted applications updated, limit user privileges, enable brute-force protection, monitor the server for suspicious activity, and maintain reliable off-server backups. For administrators managing an entire cPanel & WHM server, security should also include firewall configuration, SSH hardening, Security Advisor scans, secure TLS settings, and regular reviews of user access.
The most important principle is consistency. A server that was securely configured six months ago may no longer be secure today if software has become outdated, employees have changed, unused accounts remain active, or new vulnerabilities have appeared.
Treat cPanel security as a continuous process, and you will significantly reduce both the likelihood and potential impact of a hosting account compromise.
