Recommended Security Settings Checklists
This section contains suggestions that you can use to quickly reference whether you use the security settings that we recommend.
We recommend that you review the following settings in WHM's Tweak Settings interface (Home >> Server Configuration >> Tweak Settings) to help secure your server.
Setting Recommendation Enable HTTP Authentication
If you enable this setting, WHM will allow HTTP Authentication for cPanel/WebMail/WHM Logins. We do not recommend that you enable this setting because certain types of XSRF attacks rely on cached HTTP Auth credentials. As long as you do not enable this setting, WHM will require cookie authentication, which helps to prevent certain types of attacks.
Off Cookie IP Validation
If you enable this setting, WHM limits the ability of attackers who capture cPanel session cookies and attempt to access the cPanel and WHM interfaces. For this setting to work best, you should also disable proxy domains.
On Proxy Subdomain Creation
If you disable this option, WHM removes the ability for cPanel, Webmail, WebDisk, and WHM proxy subdomain DNS entries to be added to new accounts.
Off Require SSL
If you enable this option, WHM requires logins from remote locations to use SSL.
On Security Tokens
If you enable this option, WHM will require you to use security tokens to access any cPanel & WHM associated interface. This helps to prevent XSRF attacks.
On Block Common Domains Usage
If you enable this option, WHM will not allow users to add or park common Internet domains. For example,
On Initial default/catch-all forwarder destination
If you select Bounce for this option, the server will automatically discard unroutable email that is sent to email accounts that use default settings. This is the best option to protect your server against mail attacks.
We recommend that you also review the following settings in WHM's Security Center interface (Home >> Security Center) to help secure your server.
Setting Recommendation Password Strength Configuration
This feature allows you to specify a minimum password strength for accounts that your server hosts.
A value of
PHP open_basedir Tweak
If you enable this option, users must manually specify the
open_basdirsetting in their relevant
php.inifiles if PHP is configured to run as a CGI, SuPHP, or FastCGI process.
Enabled Apache mod_userdir Tweak
If you enable this option, users can not bypass bandwidth limits when they access their sites with a tilde (
~), username, and hostname/ For example,
Enabled Compiler Access
When you disable compiler access for unspecified users, it will help prevent attacks on your server.
Disabled Manage Wheel Group Users
This feature allows you to define which users can use the
sucommand to become the
Remove all users except for
rootand your main account.
Shell Fork Bomb Protection
If you enable this option, WHM will not allow users with terminal access from to use all of the resources on the server.
Note: If you enable this option, it may cause resource shortage problems as this setting heavily limits various resources.
Enabled FTP Configuration Disable Anonymous FTP Manage Shell Access Disable shell access for all other users. cPHulk Brute Force Protection
If you enable this option, use the White/Black List Management tab to add trusted IPs. This will prevent you from being locked out if someone attempts to brute force your server.
We recommend that you disable identification output for Apache. To change this setting:
- Log in to WHM and access the Apache Global Configuration feature (Home >> Service Configuration >> Apache Configuration >> Global Configuration).
- Select Off (PCI Recommended) from the ServerSignature menu.
- Click Save.
When you configure EasyApache, include the following modules:
- suPHP — This module causes PHP scripts to run as the owner of the script versus the nobody user.
- Suhosin — This module is an advanced protection system for PHP installations. For more information, read the Suhosin website.
- mod_security — This module is an open-source web application firewall. For more information, read cPanel's ModSecurity documentation.
We suggest that you do not include the following modules unless absolutely necessary:
- mod_frontpage — We no longer provide FrontPage in EasyApache by default. The option will only be available in EasyApache if you install the Custom Module. We do not recommend that you install FrontPage as it may introduce a vulnerability to your server. FrontPage was End-Of-Lifed by Microsoft on June 30, 2006. Microsoft no longer releases updates or security patches for FrontPage.
- mod_perl — This module allows unlimited control to scripts over the website, and it can be unsafe in a shared hosting environment.
- mod_JK — This module runs code as a shared user and presents a security risk.
- mod_Mono —This module runs code as a shared user and presents a security risk.
- mod_Mono2 —This module runs code as a shared user and presents a security risk.
- Xcache — This module has shared caching logic, and it is disabled by default.
- EAccelerator — This module has shared caching logic, and it is enabled by default.
- Any other modules that are marked as End-Of-Life or Deprecated.
Finally, we urge you to keep up to date with the most recent stable versions of software, such as PHP or Apache.