Control Panel Hardening: A Web Hosting Security Checklist

November 2026 • Security

Control panel hardening means reducing what an attacker can reach and what a stolen password or a software flaw can do. A hosting control panel is a high-value target: it can create accounts, read site files, change DNS and, with root access, control the whole server. This checklist covers the steps that apply to any panel, and gives the cPanel settings and PFHW's approach for each.

Use it as a web hosting security checklist for an audit, or as a cPanel security checklist for a server you run. It is a starting point. No checklist guarantees that a server is safe, and we explain why at the end.

Why panel hardening matters

In April 2026, WebPros published an advisory for CVE-2026-41940, a critical authentication bypass in cPanel and WHM. Help Net Security reported that it let unauthenticated attackers gain administrator-level access, that it was exploited before the patch, and that the affected ports were 2083, 2087, 2095 and 2096. Among the mitigations it listed were updating, and blocking those ports at the firewall. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 30 April. We cover this case in our page on cPanel security.

The lesson applies to every panel: software flaws will occur, so the panel should not be reachable by everyone. The OWASP Top 10 2025, as reported by The Register, ranks broken access control first and security misconfiguration second. Both concern how access is designed and configured, which a checklist can help with.

Two frameworks help you decide how far to go. NIST SP 800-123, the guide to general server security, covers selecting, deploying and maintaining servers across access control, audit, configuration management, authentication and other areas. The CIS Benchmarks are community-developed secure configuration recommendations, with more than 100 benchmarks across 25 or more vendor product families, free as PDF for non-commercial use. Use a benchmark for your operating system as the baseline under the panel.

The control panel hardening checklist

1. Reduce exposure

• Restrict panel ports by IP address or VPN. Allow the panel only from office addresses or a VPN. In WHM, Host Access Control allows, rejects or drops access to services such as cPanel, WHM and SSH for chosen IP addresses. The documentation warns that you can lock yourself out, so test with a second session open.
• Remove what you do not need. NIST SP 800-123 says to remove unneeded services and applications, and prefers removal to disabling.
• Disable password login for SSH. Use key-based login. In OpenSSH this is the PasswordAuthentication setting; the sample configuration file ships with it commented out, so the default is password login enabled. Also check PermitRootLogin; the sample file shows the default as prohibit-password.
• Use a host firewall that denies by default and opens only the ports you use.

2. Strong authentication

• Two-factor authentication. cPanel supports time-based one-time codes from an app such as Google Authenticator, and offers a Two-Factor Authentication security policy for WHM.
• Password policy. cPanel's Security Policy can enforce minimum password strength and a maximum password age. Its recommended-settings page says to set the strength to 50 or higher.
• Verified IPs. The cPanel Security Policy can limit logins to verified IP addresses, with security questions for new addresses.
• Brute-force protection. cPanel's cPHulk watches cPanel, WHM, mail, FTP and SSH logins and blocks by account and by IP address. Add your own IP to its whitelist first.

3. Keep software current

• Patch on a schedule. NIST SP 800-123 lists testing and applying patches in a timely manner as an ongoing task. cPanel's own checklist says to enable automatic updates in Update Preferences and to subscribe to cPanel's security updates.
• Update applications and remove unused plugins and themes. This is the part that usually stays with the site owner.
• Avoid end-of-life software. The cPanel recommended-settings page advises against modules marked End-Of-Life or Deprecated.

4. Filter and scan

• Web application firewall. The OWASP Core Rule Set supplies rules for ModSecurity-compatible firewalls and covers many attack categories in the OWASP Top Ten. In cPanel you install the OWASP rule set as an EasyApache 4 package or from the command line, and manage it under ModSecurity Vendors. cPanel warns that it can block legitimate traffic, so review the logs regularly.
• Malware scanning. cPanel offers a ClamAV scanner plugin, which flags files that contain threats.
• Security scanner. cPanel's Security Advisor scans the server and advises on fixes.

5. Protect data and access paths

• Backups. NIST SP 800-123 says to back up critical information frequently. In WHM you can schedule backups with retention and send them to destinations such as SFTP, S3-compatible storage or a local directory. Store copies off the server and test a restore.
• Least-privilege API tokens. A WHM token needs at least one ACL privilege and can be limited to IP addresses or CIDR ranges, up to 100 entries. It can expire; the default is one year. cPanel warns that the Everything privilege equals root, and that some privileges can bypass the token's own restrictions.
• Account isolation. cPanel's checklist names CloudLinux and CageFS to keep accounts apart. Its recommended settings include disabling shell access for accounts that do not need it, open_basedir and running PHP as the account owner.
• Encrypted connections. cPanel's checklist advises forcing SSL for panel services and allowing only TLS 1.2 and 1.3.

6. Watch and alert

• Logs and alerts. cPanel's checklist recommends reviewing security logs regularly and setting up notifications for unusual activity.
• Review on a schedule. The same checklist suggests a manual audit each quarter. Keep a written list of who has panel and root access, and remove people who have left.

Checklist table: cPanel and PFHW side by side

The middle column comes from cPanel documentation. The right column states only what we know about PFHW; "not documented" means we have no verified statement to make here.

cPanel sources: docs.cpanel.net pages on recommended security settings, security policies, Host Access Control, cPHulk, ModSecurity and OWASP CRS, API tokens, backup configuration and two-factor authentication, plus cPanel's own security checklist blog post. PFHW source: cloudacropolis.com/managed-web-server.

How to check that the settings work

1. Scan your server from outside your network and list open ports. Compare the list with what you meant to expose.
2. Try to open the panel from an address that is not allowed. It should fail.
3. Try three wrong passwords for a test account and confirm that brute-force protection reacts.
4. Send a test request that a WAF rule should block and look for it in the WAF log.
5. Restore a backup to a test location and open the restored site.
6. Create a test API token with a short expiry and confirm that it stops working.

No checklist guarantees safety

Each item reduces risk; none removes it. The cPanel documentation says the OWASP rule set does not make a server impervious. A zero-day flaw, like the one reported in 2026, can bypass settings that were correct. A WAF can produce false alarms or miss an attack. A checklist also ages: re-read it when software and threats change.

What you can do is limit exposure, detect problems early and keep tested backups to shorten the time an incident lasts. Assume that an incident will happen once, and plan the response in advance.

Where PFHW fits, and where it does not

Where it fits

• You want the panel's security features in the product: ModSecurity with OWASP rules, brute-force protection, ClamAV scanning, a host firewall with confirm-or-revert, a Security Advisor and two-factor or passkey login.
• You want an admin policy that requires verified IPs and two-factor login, and API tokens with expiry and IP restriction.
• You want engineers to handle operating system security patches, firewall maintenance and backup administration, while you keep control of your sites.

Where it does not, or where you should check first

• Managed does not mean risk-free. Your site code and plugins stay your responsibility.
• GPG encryption of backups is off by default; turn it on if you need it.
• SSH hardening beyond refusing password logins, VPN-only access and account isolation internals are not documented on this page. Ask us before you rely on them.
• There is no automatic certificate issuing.
• There is no "forgot password" by email flow in the panel.
• If you self-host PFHW from the free download, there is no support, and you maintain the server yourself.

Frequently asked questions

What is control panel hardening?

It is the set of steps that reduce the attack surface of a hosting control panel and limit the damage of a stolen password or a software flaw. Typical steps are IP restriction, two-factor login, patching, a firewall, a WAF and tested backups.

Should the cPanel login be open to the whole internet?

It is safer to restrict it. cPanel offers Host Access Control and a verified-IP policy for this. After CVE-2026-41940, a report listed blocking ports 2083, 2087, 2095 and 2096 at the firewall among the mitigations.

Is two-factor authentication enough?

No. It protects against stolen passwords, but not against a flaw that bypasses the login, as the 2026 cPanel case showed. Combine it with IP restriction and patching.

How often should I patch a hosting server?

NIST SP 800-123 asks for testing and applying patches in a timely manner. cPanel's checklist recommends automatic updates. For critical flaws that are exploited, apply fixes as soon as they are available.

Do I need a WAF if I update my sites?

A WAF adds a second layer that can block known attack patterns while you patch. It can also block legitimate users, so review its logs. It does not replace updates.

Which of these does PFHW cover?

PFHW includes a ModSecurity WAF with OWASP rules, brute-force protection, ClamAV scanning, a host firewall, two-factor or passkey login and API tokens with expiry and IP restriction. See the table for the items we do not document.

Related resources

• cPanel security vulnerabilities in 2026
• Website backup strategy and the 3-2-1 rule
• Web hosting control panels: a guide
• Managed cPanel vs managed PFHW
• Separate mail server and web server

Sources

• NIST SP 800-123, Guide to General Server Security, NIST
• NIST SP 800-123 publication page, NIST CSRC
• CIS Benchmarks overview, Center for Internet Security
• ModSecurity Core Rule Set, OWASP Developer Guide
• OWASP Top 10 2025 report, The Register
• Recommended security settings, cPanel documentation
• Configure security policies, cPanel documentation
• Two-factor authentication for WHM, cPanel documentation
• Host Access Control, cPanel documentation
• cPHulk brute force protection, cPanel documentation
• OWASP ModSecurity CRS, cPanel documentation
• Manage API tokens in WHM, cPanel documentation
• Backup configuration, cPanel documentation
• The ultimate cPanel security checklist for sysadmins, cPanel
• cPanel zero-day exploited (CVE-2026-41940), Help Net Security
• Sample sshd_config, OpenSSH source
• Managed Web Server, CloudAcropolis

Request a demo