10 cPanel Security Settings Every Website Owner Should Enable

Most hacked websites are not targeted personally; they are found by automated bots scanning for weak passwords, outdated software and open doors. The good news is that cPanel already contains many tools to close those doors, and most take only a few minutes to set up. Here are ten cPanel security settings every website owner should enable, explained in simple steps.

Quick overview

#	Setting	Where to find it in cPanel	Protects against
1	Two-Factor Authentication	Security → Two-Factor Authentication	Stolen or guessed passwords
2	Strong, unique passwords	Preferences → Password & Security	Brute-force attacks
3	SSL and Force HTTPS	Security → SSL/TLS Status; Domains	Data interception
4	Up-to-date PHP	Software → MultiPHP Manager	Known PHP vulnerabilities
5	ModSecurity	Security → ModSecurity	Common web attacks
6	Directory Privacy	Files → Directory Privacy	Unwanted access to folders
7	IP Blocker	Security → IP Blocker	Abusive visitors and bots
8	Hotlink Protection	Security → Hotlink Protection	Bandwidth theft
9	SSH keys	Security → SSH Access	Password-based SSH attacks
10	Regular backups	Files → Backup	Data loss after any incident

Menu locations can vary slightly depending on your host’s setup. If you cannot find a tool, use the search box at the top of cPanel.

1. Turn on Two-Factor Authentication (2FA)

With 2FA, logging in needs your password plus a six-digit code from an app on your phone. Even if someone steals your password, they cannot get in without your phone.

1. Install an authenticator app such as Google Authenticator, Microsoft Authenticator or a similar app.
2. In cPanel, open Two-Factor Authentication in the Security section.
3. Click Set Up Two-Factor Authentication.
4. Scan the QR code with your app, enter the six-digit code it shows and click Configure Two-Factor Authentication.

Tip: Save the setup key in a safe place. If you lose or change your phone without it, you will need your host’s help to log in again.

2. Use strong, unique passwords everywhere

Your cPanel password protects everything, including websites, email and databases. Change it from Password & Security under Preferences, and use the Password Generator to create a long random password. Store it in a password manager rather than a notebook or a WhatsApp message. Apply the same rule to email accounts, FTP accounts, database users and your WordPress admin. Never reuse the same password across services, because one leak would expose all of them.

3. Install SSL and force HTTPS

SSL encrypts data between your visitors and your server. Open SSL/TLS Status and click Run AutoSSL to get a free certificate if one is not already installed. Then go to Domains and switch on Force HTTPS Redirect for each domain so visitors always use the secure version. Remember to log in to cPanel and webmail using https:// as well, especially on public Wi-Fi.

4. Keep PHP up to date with MultiPHP Manager

Older PHP versions stop receiving security fixes after their end-of-life date. Running them leaves your site exposed to known weaknesses.

1. Open MultiPHP Manager in the Software section.
2. Check the PHP version shown next to each domain.
3. Tick the domain, choose a newer, supported version from the drop-down and click Apply.
4. Test your website carefully. If something breaks, switch back and update the plugin or theme causing the problem before trying again.

Along with PHP, keep WordPress core, themes and plugins updated, and delete any you no longer use.

5. Enable ModSecurity

ModSecurity is a web application firewall that blocks common attacks such as SQL injection and cross-site scripting before they reach your site. In cPanel, open ModSecurity under Security and make sure it is On for all your domains. Many hosts enable it by default. If a genuine feature of your website is blocked, do not simply switch ModSecurity off; ask your host to whitelist the specific rule instead.

6. Protect private folders with Directory Privacy

Directory Privacy adds a username and password prompt to any folder, which is useful for admin areas, staging sites or private downloads.

1. Open Directory Privacy under Files.
2. Click Edit next to the folder you want to protect, for example public_html/staging.
3. Tick Password protect this directory, give it a name and click Save.
4. Create a user with a strong password under Create User.

Some site owners also protect the WordPress wp-admin folder this way for an extra layer, but test carefully because some plugins rely on files inside it.

7. Block abusive visitors with IP Blocker

If you notice repeated login attempts, spam or suspicious traffic from certain addresses in your logs or Visitors report, block them with IP Blocker. Enter a single IP address (such as 203.0.113.25), a range, or a domain name and click Add. Be careful not to block your own IP address or the IP of a service you depend on. IP blocking is a targeted fix, not a full solution, because attackers often change addresses.

8. Stop bandwidth theft with Hotlink Protection

Hotlinking happens when another site displays your images directly from your server, using your bandwidth. Open Hotlink Protection under Security and click Enable. Check that the list of allowed URLs includes all versions of your domain, such as https://yourdomain.com and https://www.yourdomain.com. Keep the default file extensions (such as jpg, jpeg, gif, png) and add others if needed. If you use a CDN, add its address to the allowed list too.

9. Use SSH keys instead of passwords

If your plan includes SSH access, keys are far more secure than passwords. Open SSH Access under Security and click Manage SSH Keys. You can either Generate a New Key or Import Key to add a public key you created on your computer. After adding it, click Manage and Authorize the key. Protect your private key with a passphrase and never share it. If you never use SSH, ask your host whether it can be disabled for your account.

10. Take regular backups

No security setup is perfect, so backups are your safety net. Use the Backup page under Files to download a full account backup or individual home directory and database backups. If your host provides a tool such as JetBackup, check how often it runs. Keep at least one copy off the server, on your computer or cloud storage, and take a fresh backup before major updates.

Extra tips

• Check file permissions: folders should normally be 755 and files 644. Avoid 777, which lets anyone write to a file.
• Remove unused items: delete old FTP accounts, unused email accounts, test installations and forgotten subdomains.
• Keep your contact email current: in Contact Information under Preferences, set an address you check and enable notifications so you hear about issues such as quota warnings or SSL problems.
• Review logs: tools such as Raw Access, Errors and Visitors under Metrics can reveal suspicious activity.
• Use a scanner if available: some hosts include a malware scanner in cPanel; run it occasionally.

Frequently asked questions

Which setting should I enable first?

Start with a strong password and Two-Factor Authentication, because they protect access to everything else. Then add SSL and backups.

Will ModSecurity slow down my website?

The effect is usually very small and the protection is well worth it. If you notice a problem, contact your host rather than disabling it.

Do these settings replace a WordPress security plugin?

No. cPanel protects the hosting account and server side, while a security plugin adds WordPress-specific protection. They work best together.

What if I get locked out after enabling 2FA?

Contact your hosting provider. They can disable 2FA for your account after verifying your identity.

Conclusion

Securing your cPanel account does not need technical expertise or extra spending. Enable 2FA, use strong passwords, force HTTPS, keep PHP updated, leave ModSecurity on, use Directory Privacy, IP Blocker and Hotlink Protection where they help, switch to SSH keys and keep regular backups. Spend half an hour on these settings today and your website will be a much harder target.