1. Turn on automatic updates

In WHM, open Server Configuration > Update Preferences and set cPanel and operating system updates to Automatic. Make sure EasyApache 4 packages, including PHP, update with the system. Most attacks use flaws that already have a fix.

2. Use strong passwords and two-factor authentication

• Set a minimum password strength in WHM > Security Center > Password Strength Configuration.
• Turn on Two-Factor Authentication in the Security Center, and ask every reseller and cPanel user to enable it under Security > Two-Factor Authentication.
• Use a password manager, and never reuse the root password anywhere else.

3. Protect SSH

Use SSH keys instead of passwords, and turn off password logins once your key works. Keep a second session open while you test changes. Our SSH troubleshooting guide shows how to change settings safely.

# /etc/ssh/sshd_config (after your key login works)
PasswordAuthentication no
PermitRootLogin prohibit-password

4. Turn on cPHulk

cPHulk blocks addresses that fail too many logins to WHM, cPanel, webmail, email and SSH. Enable it in WHM > Security Center > cPHulk Brute Force Protection, and add your own fixed IP addresses to its allow list so you can never block yourself.

5. Run a firewall

Open only the ports you use. CSF works well with WHM; see our CSF firewall guide. If you use a security suite such as Imunify360, use its firewall instead of running two.

6. Enable ModSecurity

ModSecurity is a web application firewall that blocks common attacks on websites. In WHM > Security Center > ModSecurity Vendors, install a rule set such as the OWASP Core Rule Set, then watch ModSecurity Tools for false positives. See our ModSecurity guide.

7. Make every site use HTTPS

Turn on AutoSSL in WHM > SSL/TLS > Manage AutoSSL for all users. Certificates renew automatically. Ask site owners to force HTTPS in their CMS or with a redirect.

8. Scan for malware

Scan home folders regularly with ImunifyAV, Linux Malware Detect or ClamAV, and act on the reports.

9. Isolate accounts

On shared or reseller servers, CloudLinux with CageFS keeps each account in its own environment, and PHP-FPM runs each site as its own user. A hacked site then cannot read or change other accounts.

10. Remove what you do not use

• Uninstall PHP versions no site uses, in EasyApache 4.
• Turn off services you do not need in WHM > Service Configuration > Service Manager.
• Prefer SFTP over plain FTP, and turn FTP off if nobody uses it.
• Remove old accounts and staging copies.

11. Limit outgoing mail

Set hourly sending limits and turn on SMTP Restrictions, so a hacked account cannot send thousands of spam messages. See our anti-spam settings guide.

12. Keep off-server backups

Configure WHM > Backup > Backup Configuration with a remote destination, keep several days or weeks of copies, and test a restore regularly. Backups are what save you when everything else fails.

If an account is hacked

1. Suspend the account or block its outgoing mail, so the damage stops spreading.
2. Find the way in: outdated plugins, stolen passwords or a vulnerable script.
3. Clean or restore the files, update everything, and change all passwords for the account.
4. Check other accounts on the server for the same infection.

Check your work

• ✓ Run WHM > Security Center > Security Advisor and work through its warnings.
• ✓ Review lfd or cPHulk alerts each week.
• ✓ Check that updates installed: compare /usr/local/cpanel/cpanel -V with the latest release.