cPanel and WHM Security Hardening Guide: Best Practices

Securing a web hosting environment requires constant attention, especially when managing servers running cPanel and WHM. Because cPanel controls multiple websites, databases, and email accounts, it is a high-value target for attackers. Default installations are optimized for ease of use rather than maximum security, meaning administrators must take proactive steps to lock down the environment.

Whether you manage your own dedicated server or a high-performance cloud VPS, applying a solid security baseline is essential. In this guide, we will walk through practical steps to harden your cPanel and WHM environment by adjusting core configuration files, enforcing two-factor authentication and SSH keys, disabling direct root password logins, and restricting shell access for end-users.

1. Tuning Configuration Files for Enhanced Security

The main cPanel configuration file (/var/cpanel/cpanel.config) controls numerous security and behavioral aspects of the interface. While you can modify this file directly via the command line, it is usually safer to use the Tweak Settings interface in WHM or the wwwacct.conf configuration utilities. However, certain underlying tweaks help minimize your attack surface.

Note: The configuration steps and system commands in this guide apply to environments running AlmaLinux 9, which is a standard enterprise Linux distribution for modern cPanel deployments.

Log in to your AlmaLinux 9 server via SSH using a sudo-enabled user account, and let us review some critical parameters you should enforce:

• Cookie Lifespan: Reduce session durations to prevent unauthorized access if a user leaves their browser unattended.
• Non-SSL Redirects: Ensure that all traffic is forced over HTTPS by default.
• Brute Force Protection: Enable automated triggers that block IPs exhibiting suspicious login behavior.

To configure these settings directly through WHM, navigate to Server Configuration > Tweak Settings. Look for security-related items such as "Require SSL for cPanel services" and set them to "On". This ensures that credentials and session cookies are never transmitted in plaintext.

2. Enforcing Strict Two-Factor Authentication (2FA) and SSH Keys

Passwords alone are no longer enough to protect administrative accounts. Credential stuffing and brute-force attacks mean that a single compromised password can lead to a full server takeover. Enforcing Two-Factor Authentication (2FA) in WHM adds a critical layer of defense.

To enforce 2FA for all administrative and user accounts on your AlmaLinux 9 server:

1. Log in to your WHM dashboard.
2. Navigate to Security Center > Two-Factor Authentication.
3. Click on the Manage Security Policies tab.
4. Enable the policy requiring all users with administrative privileges (or all users globally) to configure 2FA using a compatible time-based one-time password (TOTP) application like Google Authenticator or Authy.

Next, you must secure server-level SSH access. Password-based authentication for SSH should be disabled entirely in favor of cryptographic SSH keys. Open your SSH configuration file using a text editor on AlmaLinux 9:

sudo nano /etc/ssh/sshd_config.d/01-security.conf

This command opens a dedicated SSH security configuration file using the nano text editor with administrative privileges.

Add the following directives to enforce key-only authentication and disable root password logins:

PubkeyAuthentication yes
PasswordAuthentication no
PermitRootLogin prohibit-password

Save the file and restart the SSH service on AlmaLinux 9 to apply the changes:

sudo systemctl restart sshd

This command restarts the SSH daemon so that your newly applied configuration rules take effect immediately.

This ensures that even if an attacker guesses a weak password, they cannot log in via SSH without the corresponding private key.

3. Disabling Root Password Login and Managing Sudoers

Allowing direct root logins over the network is a major security risk. Even if you use strong keys, best practices dictate that administrators should log in with an unprivileged user account and elevate privileges using sudo when administrative tasks are required.

If you have not already created a dedicated administrative user on your AlmaLinux 9 server, do so now:

sudo adduser adminuser
sudo passwd adminuser

The adduser command creates a new user account, and the passwd command assigns a secure password to that user.

Grant this user administrative privileges by adding them to the wheel group:

sudo usermod -aG wheel adminuser

This command appends the specified user to the wheel group, granting them permission to execute commands with administrative privileges using sudo.

Once your sudo user is established and you have verified that you can log in and run commands with sudo, ensure that direct root access is restricted in WHM as well. Navigate to Security Center > Root Password to update root credentials regularly, and use WHM > WHM Root Password management tools safely behind your newly enforced 2FA walls.

4. Locking Down Shell Access for End-Users

cPanel hosting accounts often house multiple websites, developers, and clients. If an end-user has unrestricted shell access, a compromised web application or a malicious user could potentially execute unauthorized binaries, scan local ports, or attempt local privilege escalation against the underlying AlmaLinux 9 operating system.

To restrict shell access globally or per package:

1. In WHM, navigate to Packages > Edit a Package.
2. Select the hosting package you want to modify (for example, your default or standard user packages).
3. Locate the Shell Access setting.
4. Change the setting from "Normal Shell" or "Jail Shell" to Disabled for clients who do not explicitly require command-line access.

If your clients or developers genuinely require command-line access (for instance, to run Composer or Git commands), you should always enforce a Jail Shell (CageFS or cPanel's built-in jailed shell environment). A jailed shell restricts users to their own home directories, preventing them from viewing system files, running unauthorized processes, or inspecting other users' directories.

To update an individual account's shell type via WHM, go to Account Information > Modify an Account, select the target domain, and update the shell dropdown to Jail Shell.

5. Monitoring and Auditing Your Security Baseline

Hardening is not a one-time task; it requires ongoing verification. Regularly check your WHM Security Advisor tool, which scans your server configuration for common vulnerabilities and alerts you to missing security patches or loose permissions.

You can access the security scanner directly within your interface by navigating to Security Center > Security Advisor. Review any yellow or red warnings generated by the system and apply the recommended fixes promptly.

Additionally, monitor your authentication logs on AlmaLinux 9 to spot unauthorized access attempts early:

sudo tail -f /var/log/secure

This command streams the end of the secure authentication log in real-time, allowing you to watch login events as they occur.

Reviewing this log helps you identify failed brute-force attacks and confirms that your firewall and SSH hardening rules are actively dropping unauthorized connection attempts.

Conclusion

Securing a cPanel and WHM environment requires a layered approach. By moving beyond default settings, you significantly reduce the risk of unauthorized access and system compromise. Tuning your configuration files, enforcing mandatory two-factor authentication, replacing SSH passwords with cryptographic keys, and restricting end-user shell access creates a resilient hosting platform.

Take the time to review your WHM Security Advisor and server logs regularly. Maintaining a strict security baseline ensures that your applications, data, and users remain protected against evolving threats.