Initial WHM Server Setup Checklist: 10 Critical Steps After Installing cPanel/WHM

Installing cPanel & WHM on a freshly provisioned Linux server takes less than twenty minutes, but launching production websites on a default, unhardened WHM installation is an invitation to disaster. Out of the box, WHM operates with permissive firewall policies, disabled brute-force protections, default PHP compile profiles, and unconfigured email deliverability standards on a Linux VPS.

Before deploying your first client account or pointing production DNS records, every server administrator must execute a methodical hardening routine. Follow this battle-tested 10-step checklist to lock down security, optimize web server throughput, and ensure 100% email inbox delivery.

1. Change Default SSH Port & Disable Password Authentication

Automated botnets probe SSH port 22 relentlessly. Relocate the SSH daemon to a non-standard port and enforce public key authentication exclusively:

# Edit SSH daemon config
sudo nano /etc/ssh/sshd_config

# Set hardened directives
Port 2222
PermitRootLogin prohibit-password
PasswordAuthentication no

# Restart SSH service
sudo systemctl restart sshd

2. Install ConfigServer Security & Firewall (CSF)

While WHM includes basic iptables management, ConfigServer Security & Firewall (CSF / LFD) is the undisputed gold standard for cPanel security:

cd /usr/src
rm -fv csf.tgz
wget https://download.configserver.com/csf.tgz
tar -xzf csf.tgz && cd csf
sh install.sh

Open /etc/csf/csf.conf, set TESTING = "0", add your custom SSH port (e.g., 2222) to TCP_IN, and restart via csf -r.

3. Enable cpHulk Brute Force Protection

cpHulk defends cPanel, WHM, webmail, FTP, and email ports against distributed password guessing attacks:

1. In WHM, navigate to Security Center > cpHulk Brute Force Protection.
2. Toggle the service to Enabled.
3. Under Configuration Settings, set:
   • IP-Based Protection: Ban IP after 5 failed login attempts within 15 minutes.
   • Duration: Set ban duration to 1 day or permanent.
4. Under Whitelist Management, immediately add your static administrative office or home IP addresses to prevent accidental lockouts.

4. Optimize Web Server via EasyApache 4

The default Apache profile compiles outdated PHP modules and inefficient multiprocessing modules (MPM):

1. Navigate to Software > EasyApache 4.
2. Select Customize Current Profile.
3. Apache MPM: Ensure mpm_event is active; disable legacy mpm_prefork.
4. PHP Versions: Install modern PHP 8.2 and PHP 8.3. Mark legacy versions (7.4, 8.0) as inactive.
5. PHP Extensions: Install opcache, redis, imagick, intl, curl, and mbstring.

5. Activate ModSecurity & OWASP Core Rule Set

Block application-layer exploits (SQL injection, XSS, and remote code execution) before they reach web processes:

1. Navigate to Security Center > ModSecurity Vendors.
2. Click Add Vendor and enable the official OWASP ModSecurity Core Rule Set.
3. Navigate to ModSecurity Configuration and set SecRuleEngine to On.

6. Configure Reverse DNS (PTR) & Hostname

Ensure your server hostname is a fully qualified domain name (FQDN) matching a valid public DNS A record (e.g., server1.youragency.com). In your hosting provider console, set the Reverse DNS (PTR) record for your primary IPv4 address to match this exact hostname to prevent outbound emails from being flagged as spam.

7. Enforce DKIM, SPF & DMARC Email Baselines

Prevent email spoofing and ensure 100% inbox placement:

1. Navigate to DNS Functions > Enable DKIM/SPF Globally.
2. Verify that Exim automatically signs outbound messages with 2048-bit cryptographic DKIM keys.
3. Add a global DMARC policy record to your primary DNS zone:

   v=DMARC1; p=quarantine; rua=mailto:[email protected]; pct=100

8. Tune MySQL / MariaDB via /etc/my.cnf

WHM ships with conservative database parameters. Allocate at least 50% of available server RAM to the InnoDB buffer pool in /etc/my.cnf:

[mysqld]
innodb_buffer_pool_size = 2G
innodb_log_file_size = 512M
innodb_flush_log_at_trx_commit = 2
innodb_flush_method = O_DIRECT
max_connections = 250

9. Configure Automated Offsite Encrypted Backups

Never rely on local backups stored on the same physical drive as your live websites:

1. Navigate to Backup > Backup Configuration.
2. Enable Scheduled Backups (Daily incremental).
3. Under the Additional Destinations tab, connect an S3-compatible cloud storage bucket (Cloudflare R2, AWS S3, or Wasabi).
4. Ensure system files (/etc/) and MySQL databases are included in the archive.

10. Enable Tweak Settings Security Directives

Navigate to Server Configuration > Tweak Settings and enable these vital safeguards:

• Prevent ‘nobody’ from sending mail: On (Stops rogue scripts from sending unauthenticated spam).
• Reset password for cPanel accounts: Require strong passwords (minimum strength score 80).
• Cookie IP Validation: Strict (Prevents session hijacking if an administrative session cookie is stolen).

Automated Server Health Monitoring & Mail Queue Triage in WHM

Maintaining high availability across multi-tenant cPanel servers requires real-time health monitoring and automated queue maintenance:

• Automating Service Recovery via ChkServd: WHM includes a native monitoring daemon named ChkServd. Navigate to Service Configuration > Service Manager and ensure monitoring and automated restart checkboxes are enabled for:
  • cpsrvd (cPanel/WHM web service)
  • httpd (Apache / OpenLiteSpeed)
  • mysql (MariaDB database daemon)
  • exim (SMTP mail transfer agent)
  • named (BIND / PowerDNS nameserver)

  If any service deadlocks or terminates unexpectedly, ChkServd automatically revives the process within 60 seconds and emails an incident diagnostic report to the root administrator.

• Managing the Exim Outbound Mail Queue: Prevent backlogged email queues using the Exim command-line interface via terminal:

  # View current queue count
  exim -bpc
  
  # Inspect top sender domains currently sending mail
  exim -bp | exiqsumm
  
  # Purge frozen spam messages from the queue immediately
  exiqgrep -z -i | xargs exim -Mrm

• Automating Daily Security Scans with ClamAV / Maldet: Deploy Linux Malware Detect (LMD / Maldet) alongside ClamAV to automatically scan newly uploaded files inside /home/*/public_html every night, automatically quarantining suspicious web shells.