How to Configure cPanel / WHM Packages, Feature Lists & Resource Quotas

In web hosting, unconstrained resource allocation leads directly to server instability. If a single customer’s WordPress site experiences a sudden traffic spike or gets compromised by a malicious spam script, an unmetered cPanel account can consume 100% of server disk I/O, fill the entire physical filesystem, and crash the MariaDB database for every other tenant on the machine.

To build a profitable, scalable hosting business on your Linux VPS, you must master WHM Packages and Feature Lists. WHM packages define the boundaries of every client account: storage quotas, bandwidth allowances, maximum email accounts, database limits, and accessible cPanel tools. In this tutorial, you will learn how to design tiered retail hosting plans, lock down security using Feature Manager, and enforce multi-tenant stability.

1. Designing Tiered Hosting Packages

Successful hosting companies structure their offerings into three distinct, clear product tiers that cater to varying client requirements while encouraging plan upgrades:

2. Creating Packages in WebHost Manager (WHM)

To create a new package in WHM:

1. Log in to WHM and navigate to Packages > Add a Package.
2. Enter the Package Name (e.g., Starter_5GB).
3. Define storage quotas:
   • Disk Quota (MB): 5000
   • Monthly Bandwidth (MB): 50000
   • Max FTP Accounts: 2
   • Max Email Accounts: 5
   • Max Databases: 2
   • Max Sub Domains: 5
   • Max Parked Domains: 0
   • Max Addon Domains: 0
4. Under Settings:
   • Dedicated IP: Leave unchecked (share server IP).
   • Shell Access: Disabled (crucial security baseline for shared hosting).
   • cPanel Theme: jupiter
   • Feature List: Select your hardened feature profile.
5. Click Add to save the package.

3. Hardening Security via Feature Manager

By default, cPanel exposes every installed tool to the end user. Inexperienced clients often corrupt configurations by fiddling with low-level zone editors, raw Apache handlings, or SSH terminals. Restrict accessible tools via Feature Manager:

1. In WHM, navigate to Packages > Feature Manager.
2. Enter a name for your custom feature list (e.g., Hardened_Shared_User) and click Add Feature List.
3. Disable the following high-risk features:
   • SSH / Shell Access: Prevents command-line access.
   • Raw Access Logs: Saves disk space.
   • Advanced Zone Editor: Restricts direct editing of root DNS records.
   • Track DNS / Network Tools: Prevents network reconnaissance.
4. Keep essential user features enabled: File Manager, MySQL Databases, phpMyAdmin, Email Accounts, Let’s Encrypt SSL, and WP Toolkit.

4. Enforcing CloudLinux LVE Limits (CPU, RAM & IOPS)

If your server runs CloudLinux OS (the industry standard for shared hosting environments), packages can be bound to Lightweight Virtualized Environments (LVE):

• SPEED (CPU Limit): Set to 100% (1 full CPU core). Prevents a runaway script from consuming all server cores.
• PMEM (Physical Memory): Set to 1024MB (1GB RAM) for Starter, 2048MB for Business plans.
• IO / IOPS (Disk Speed): Limit disk throughput to 10 MB/s and 1024 IOPS to prevent high-volume database queries from freezing NVMe disk arrays.
• NPROC (Max Processes): Limit concurrent processes to 30 to prevent fork bombs.

Advanced Resource Isolation: MySQL Governor & Inode Quotas in WHM

Preventing shared hosting degradation requires enforcing storage object boundaries and database query limits alongside standard disk megabytes:

• Enforcing Inode Quotas to Stop File Accumulation: Customers frequently store hundreds of thousands of tiny cache files, temporary session dumps, or unpurged email attachments that exhaust filesystem inodes even if their megabyte quota is only 20% full. In WHM, set a strict Inode Limit (e.g., 250,000 inodes for Starter, 500,000 inodes for Pro) in your package definitions.
• Restricting Runaway Database Queries with MySQL Governor: CloudLinux’s MySQL Governor monitors real-time CPU and disk I/O consumed by every database user. If a customer’s unindexed WooCommerce query spikes MariaDB, MySQL Governor automatically throttles only that specific user’s queries:

  # Check live database resource consumption per cPanel user
  dbctl list
  # Set custom CPU throttle limit for a heavy user
  dbctl set heavyuser --cpu=30

  Neighboring client databases continue executing with zero latency penalties.

• Configuring Automated Email Sending Ceilings: In WHM Tweak Settings > Mail, cap outbound messages to 100 emails/hour per domain. This prevents compromised WordPress accounts from turning your server into a spam botnet that blacklists your primary IP on Spamhaus or Barracuda.

Hosting Package Profitability & Resource Allocation Strategy

Designing profitable packages requires balancing server density with customer satisfaction:

• Implementing Automated Upgrade Prompts: When a customer approaches 90% of their allocated disk quota or bandwidth allowance, configure your billing platform (Blesta or WHMCS) to trigger an automated upgrade recommendation email. This frictionless upgrade path captures organic expansion revenue from growing businesses.
• Separating Static Storage from High-Performance Database Pools: High-ticket eCommerce stores require massive database buffers but minimal email storage. Offer specialized WooCommerce Optimized packages that feature dedicated MariaDB buffer pools, Redis caching, and NVMe read priority over standard static brochure sites.
• Enforcing Scheduled Inode and Database Maintenance: Provide value-added automated maintenance by deploying cron routines that purge expired transients, optimize fragmented database tables, and clean up abandoned customer error logs across all accounts weekly.