How to Create Subdomains and Wildcard Subdomains in cPanel (Full Tutorial)

Why Use Subdomains vs Subdirectories?

A subdomain (e.g. blog.yourdomain.com or app.yourdomain.com) operates as an independent web application with its own isolated file directory, independent SSL certificates, and separate database connections. This makes subdomains the ideal architecture for staging environments, client portals, SaaS customer tenants, and standalone WordPress installations.

Step-by-Step: Creating a Standard Subdomain in cPanel

1. Log in to your CpanelFree dashboard and click on Domains under the Domains category.
2. Click the blue Create A New Domain button.
3. In the Domain text box, enter your desired subdomain (e.g. staging.yourdomain.com).
4. CRITICAL: Uncheck the box that says “Share document root (/home/username/public_html) with domain.com”.
5. Set the Document Root path to public_html/staging (or staging.yourdomain.com).
6. Click Submit. cPanel automatically creates the folder structure, Apache virtual host, and DNS zone record.

How to Set Up Wildcard Subdomains (*.yourdomain.com)

Wildcard subdomains allow your web server to dynamically route any requested subdomain (e.g. user1.yourdomain.com, tenant42.yourdomain.com) to a single application without creating individual cPanel records for each user. This is essential for WordPress Multisite (Network) and multi-tenant SaaS platforms.

1. Create Wildcard Domain in cPanel:

Create a new domain in cPanel using the asterisk symbol: *.yourdomain.com with document root set to your main application folder (public_html).

2. Add Wildcard DNS A Record:

In cPanel Zone Editor or Cloudflare, add an A record with Name: * pointing to your server IP address.

Automated AutoSSL Issuance for Subdomains

Within 15 minutes of creating your subdomain, cPanel AutoSSL automatically communicates with Sectigo / Let’s Encrypt to provision a free, trusted SSL certificate covering both your standard and wildcard subdomains.

Configuring Document Roots and Isolated Apache VirtualHosts

When creating subdomains in cPanel, isolating the Document Root outside of the main public_html folder (e.g. /home/username/subdomains/staging) provides critical security advantages:

• Prevent .htaccess Inheritance: Subdomains placed inside public_html/subdomain/ inherit rewrite rules and security directives from the root domain’s .htaccess file, which often causes redirection loops.
• Malware Containment: If a staging subdomain is compromised by a vulnerable test plugin, isolating its document root prevents malicious PHP webshells from reading the parent website’s wp-config.php database credentials.

Automated WordPress Multisite Wildcard Subdomain Routing

To configure a multi-tenant WordPress Network using subdomains, add this line to your wp-config.php file:

/* Enable WordPress Multisite Subdomains */
define('WP_ALLOW_MULTISITE', true);
define('MULTISITE', true);
define('SUBDOMAIN_INSTALL', true);
define('DOMAIN_CURRENT_SITE', 'yourdomain.com');
define('PATH_CURRENT_SITE', '/');
define('SITE_ID_CURRENT_SITE', 1);
define('BLOG_ID_CURRENT_SITE', 1);

Paired with a wildcard DNS A record (*), WordPress will dynamically spawn fully functional sub-sites instantly upon user registration.

Managing Subdomain Security and SSL Certificates with cPanel AutoSSL

Whenever a new subdomain is created in cPanel, the automated AutoSSL engine queues the subdomain for domain-control validation (DCV). To ensure smooth validation without manual intervention:

• Ensure the subdomain’s DNS A record points directly to your cPanel shared IP address.
• Do not place restrictive .htaccess password protection rules on the .well-known/acme-challenge/ validation directory.
• Run manual certificate issuance in cPanel under SSL/TLS Status > Run AutoSSL to expedite immediate provisioning.

Configuring Staging Environments with Basic HTTP Authentication

To prevent search engine bots (Googlebot) from indexing incomplete staging subdomains and hurting your primary site’s SEO, protect the staging directory with cPanel Directory Privacy:

1. In cPanel, click Directory Privacy under the Files section.
2. Navigate to public_html/staging and check Password protect this directory.
3. Create an authorized username and strong password for your development team.

Frequently Asked Questions

Configuring Custom PHP Versions and Environment Limits per Subdomain

In cPanel’s MultiPHP Manager, you can assign different PHP versions (e.g. PHP 8.3 for your main application and PHP 8.1 for a legacy testing staging subdomain) to individual document roots, enabling isolated testing environments without affecting live production traffic.

Leveraging isolated document roots and automated wildcard routing empowers developers to build modular, secure multi-site networks and customer staging portals on cPanel effortlessly.

Regularly auditing your active subdomains and removing obsolete staging directories ensures your server storage remains clean and protected against unauthorized script executions.