A new cPanel server is attacked within minutes of getting a public IP. These twelve steps close the most common doors before your first customer arrives.
1. Update everything
Run /scripts/upcp and dnf update and enable automatic cPanel updates.
2. Use SSH keys and a non-standard setup
Disable password logins for root, use keys and limit SSH to the IPs you work from.
3. Turn on two-factor authentication
Enable 2FA for WHM and encourage it for cPanel users.
4. Install a firewall with brute-force protection
Block repeated failed logins for SSH, FTP, mail and cPanel automatically.
5. Enable ModSecurity with good rules
The OWASP Core Rule Set plus WordPress-aware exclusions stops most web attacks without breaking sites.
6. Scan uploads in real time
Most hacked sites start with an uploaded web shell. Real-time scanning catches it before it runs.
7. Isolate accounts
Use CloudLinux CageFS or at least PHP-FPM per user and disable dangerous PHP functions.
8. Keep PHP versions current
Remove end-of-life PHP versions or limit them to the accounts that need them.
9. Protect mail
Enable safe RBLs, SPF, DKIM and DMARC, and watch for accounts that suddenly send spam.
10. Watch CMS installations
Outdated WordPress plugins are the number one entry point. Get alerts for vulnerable versions.
11. Back up off the server
Keep daily backups somewhere an attacker on the server cannot delete them.
12. Monitor
Know when load, disk or a service goes wrong and when a domain gets blacklisted.
xPGuard covers steps 4, 5, 6, 9, 10 and 12 with one agent. Start a free trial.
Related posts
What Is a Web Shell and How Do Attackers Use It?
Web shells give attackers a control panel inside your website. Here is how they get in, what they do and how to stop them.
Introducing xPGuard: Proactive Security for Hosting Servers
One lightweight agent and one cloud panel for malware scanning, firewall, WAF, IP reputation and monitoring.