cPanel Security Hardening: 8 Essential Settings

cPanel Security Hardening: Complete Guide

An unsecured hosting account rarely requires sophisticated exploitation. A weak password or an outdated plugin is usually enough. This guide covers every security layer you should activate on a cPanel hosting account.

Two-Factor Authentication (2FA)

The first step is enabling two-factor authentication for your cPanel login. Navigate to "Two-Factor Authentication" in the Security section and scan the QR code with Google Authenticator or Authy. Every login will then require your password plus a six-digit code that rotates every 30 seconds. This single measure blocks the vast majority of brute force attacks.

Also enable 2FA on the primary email account associated with your hosting — that account controls password reset access.

IP Blocking

If you manage your site from a fixed location, you can restrict cPanel access to specific IP addresses. Use "IP Blocker" in cPanel or add access restrictions via .htaccess. For blocking a suspicious IP that is generating unusual traffic or failed logins, the IP Blocker section handles both individual addresses and entire ranges.

Caution: If you restrict access by IP and your IP address changes, you will lock yourself out. Always configure a recovery path.

ModSecurity (WAF)

ModSecurity is a web application firewall built into Apache. It analyzes incoming requests and blocks patterns associated with known attacks: SQL Injection, Cross-Site Scripting (XSS), Local File Inclusion (LFI), and Remote File Inclusion (RFI). In cPanel → ModSecurity, verify it is enabled for your domain.

ModSecurity occasionally blocks legitimate requests (false positives), particularly in complex applications. If you encounter unexpected 403 errors after enabling it, check the Apache error log to identify which rule triggered.

Disabling Unnecessary Features

cPanel enables several features by default that most sites do not need:

• Anonymous FTP: keep disabled at all times
• Directory Indexing: ensure your folders do not expose their contents publicly. Add Options -Indexes to your .htaccess file
• Cron Job Email: if your scheduled tasks run silently, disable the email sent on every execution to reduce noise

PHP Security Settings

Through cPanel → "Select PHP Version" or "MultiPHP INI Editor," you can enforce security-focused PHP configuration:

disable_functions = exec, passthru, shell_exec, system, popen, proc_open
expose_php = Off
display_errors = Off
log_errors = On
allow_url_fopen = Off
allow_url_include = Off

disable_functions prevents an attacker from executing system commands even if they compromise your application code. expose_php = Off removes the PHP version from HTTP response headers, eliminating one data point attackers use to target known vulnerabilities.

SSH Key Authentication

If you use SSH, disable password authentication and use key-based authentication exclusively. From cPanel → "SSH Access":

1. Generate a key pair (public and private)
2. Download the private key to your local machine
3. Authorize the public key via ~/.ssh/authorized_keys

Request your hosting provider to enforce the following in the SSH server configuration:

PasswordAuthentication no
PermitRootLogin no

كلاود provides Jailed SSH on Business and Professional shared hosting plans. Jailed SSH restricts the user to their own account environment, preventing lateral movement to other accounts on the same server even if a breach occurs.

CloudLinux LVE

On كلاود shared hosting, CloudLinux Lightweight Virtual Environment (LVE) isolates each account. Every account has defined limits for CPU, RAM, and I/O operations. If one site is compromised or experiences abnormal resource usage, the impact is contained within that account and does not affect other customers on the same server.

This makes shared hosting on CloudLinux technically more secure than traditional shared hosting configurations.

Regular Security Audits

Conduct a security review at least every two months:

1. Review FTP accounts — delete any that are no longer in use
2. Review MySQL users — remove test accounts and unused database users
3. Check file permissions — no 777 permissions without a specific reason
4. Review Cron Jobs — investigate any unfamiliar scheduled tasks
5. Review the Error Log — repeated unusual errors often indicate active probing

Security is a continuous practice, not a one-time setup. Enabling 2FA, ModSecurity, and proper PHP settings creates defense in depth — multiple layers that make your account a costly target. كلاود activates CloudLinux LVE and ModSecurity by default on all shared hosting accounts, but the application-level settings described here require your attention.

---

Get Started

Need a secure environment? Choose a protected server with DDoS protection and advanced firewall. Review our SLA and Privacy Policy.