{"id":4437,"date":"2026-09-12T17:05:03","date_gmt":"2026-09-12T11:35:03","guid":{"rendered":"https:\/\/cpanelfree.com\/blog\/initial-whm-server-setup-checklist-guide\/"},"modified":"2026-09-12T17:06:14","modified_gmt":"2026-09-12T11:36:14","slug":"initial-whm-server-setup-checklist-guide","status":"publish","type":"post","link":"https:\/\/cpanelfree.com\/blog\/initial-whm-server-setup-checklist-guide\/","title":{"rendered":"Initial WHM Server Setup Checklist: 10 Critical Steps After Installing cPanel\/WHM"},"content":{"rendered":"<p>Installing cPanel &amp; WHM on a freshly provisioned Linux server takes less than twenty minutes, but launching production websites on a default, unhardened WHM installation is an invitation to disaster. Out of the box, WHM operates with permissive firewall policies, disabled brute-force protections, default PHP compile profiles, and unconfigured email deliverability standards on a <a href=\"https:\/\/cpanelfree.com\/\">Linux VPS<\/a>.<\/p>\n<p>Before deploying your first client account or pointing production DNS records, every server administrator must execute a methodical hardening routine. Follow this battle-tested 10-step checklist to lock down security, optimize web server throughput, and ensure 100% email inbox delivery.<\/p>\n<h2>1. Change Default SSH Port &amp; Disable Password Authentication<\/h2>\n<p>Automated botnets probe SSH port 22 relentlessly. Relocate the SSH daemon to a non-standard port and enforce public key authentication exclusively:<\/p>\n<pre><code># Edit SSH daemon config\nsudo nano \/etc\/ssh\/sshd_config\n\n# Set hardened directives\nPort 2222\nPermitRootLogin prohibit-password\nPasswordAuthentication no\n\n# Restart SSH service\nsudo systemctl restart sshd<\/code><\/pre>\n<h2>2. Install ConfigServer Security &amp; Firewall (CSF)<\/h2>\n<p>While WHM includes basic iptables management, <strong>ConfigServer Security &amp; Firewall (CSF \/ LFD)<\/strong> is the undisputed gold standard for cPanel security:<\/p>\n<pre><code>cd \/usr\/src\nrm -fv csf.tgz\nwget https:\/\/download.configserver.com\/csf.tgz\ntar -xzf csf.tgz &amp;&amp; cd csf\nsh install.sh<\/code><\/pre>\n<p>Open <code>\/etc\/csf\/csf.conf<\/code>, set <code>TESTING = \"0\"<\/code>, add your custom SSH port (e.g., <code>2222<\/code>) to <code>TCP_IN<\/code>, and restart via <code>csf -r<\/code>.<\/p>\n<h2>3. Enable cpHulk Brute Force Protection<\/h2>\n<p>cpHulk defends cPanel, WHM, webmail, FTP, and email ports against distributed password guessing attacks:<\/p>\n<ol>\n<li>In WHM, navigate to <strong>Security Center &gt; cpHulk Brute Force Protection<\/strong>.<\/li>\n<li>Toggle the service to <strong>Enabled<\/strong>.<\/li>\n<li>Under <strong>Configuration Settings<\/strong>, set:\n<ul>\n<li><em>IP-Based Protection:<\/em> Ban IP after 5 failed login attempts within 15 minutes.<\/li>\n<li><em>Duration:<\/em> Set ban duration to 1 day or permanent.<\/li>\n<\/ul>\n<\/li>\n<li>Under <strong>Whitelist Management<\/strong>, immediately add your static administrative office or home IP addresses to prevent accidental lockouts.<\/li>\n<\/ol>\n<h2>4. Optimize Web Server via EasyApache 4<\/h2>\n<p>The default Apache profile compiles outdated PHP modules and inefficient multiprocessing modules (MPM):<\/p>\n<ol>\n<li>Navigate to <strong>Software &gt; EasyApache 4<\/strong>.<\/li>\n<li>Select <strong>Customize Current Profile<\/strong>.<\/li>\n<li><strong>Apache MPM:<\/strong> Ensure <code>mpm_event<\/code> is active; disable legacy <code>mpm_prefork<\/code>.<\/li>\n<li><strong>PHP Versions:<\/strong> Install modern <code>PHP 8.2<\/code> and <code>PHP 8.3<\/code>. Mark legacy versions (7.4, 8.0) as inactive.<\/li>\n<li><strong>PHP Extensions:<\/strong> Install <code>opcache<\/code>, <code>redis<\/code>, <code>imagick<\/code>, <code>intl<\/code>, <code>curl<\/code>, and <code>mbstring<\/code>.<\/li>\n<\/ol>\n<h2>5. Activate ModSecurity &amp; OWASP Core Rule Set<\/h2>\n<p>Block application-layer exploits (SQL injection, XSS, and remote code execution) before they reach web processes:<\/p>\n<ol>\n<li>Navigate to <strong>Security Center &gt; ModSecurity Vendors<\/strong>.<\/li>\n<li>Click <strong>Add Vendor<\/strong> and enable the official <strong>OWASP ModSecurity Core Rule Set<\/strong>.<\/li>\n<li>Navigate to <strong>ModSecurity Configuration<\/strong> and set <code>SecRuleEngine<\/code> to <code>On<\/code>.<\/li>\n<\/ol>\n<h2>6. Configure Reverse DNS (PTR) &amp; Hostname<\/h2>\n<p>Ensure your server hostname is a fully qualified domain name (FQDN) matching a valid public DNS A record (e.g., <code>server1.youragency.com<\/code>). In your hosting provider console, set the <strong>Reverse DNS (PTR)<\/strong> record for your primary IPv4 address to match this exact hostname to prevent outbound emails from being flagged as spam.<\/p>\n<h2>7. Enforce DKIM, SPF &amp; DMARC Email Baselines<\/h2>\n<p>Prevent email spoofing and ensure 100% inbox placement:<\/p>\n<ol>\n<li>Navigate to <strong>DNS Functions &gt; Enable DKIM\/SPF Globally<\/strong>.<\/li>\n<li>Verify that Exim automatically signs outbound messages with 2048-bit cryptographic DKIM keys.<\/li>\n<li>Add a global DMARC policy record to your primary DNS zone:\n<pre><code>v=DMARC1; p=quarantine; rua=mailto:dmarc@youragency.com; pct=100<\/code><\/pre>\n<\/li>\n<\/ol>\n<h2>8. Tune MySQL \/ MariaDB via \/etc\/my.cnf<\/h2>\n<p>WHM ships with conservative database parameters. Allocate at least 50% of available server RAM to the InnoDB buffer pool in <code>\/etc\/my.cnf<\/code>:<\/p>\n<pre><code>[mysqld]\ninnodb_buffer_pool_size = 2G\ninnodb_log_file_size = 512M\ninnodb_flush_log_at_trx_commit = 2\ninnodb_flush_method = O_DIRECT\nmax_connections = 250<\/code><\/pre>\n<h2>9. Configure Automated Offsite Encrypted Backups<\/h2>\n<p>Never rely on local backups stored on the same physical drive as your live websites:<\/p>\n<ol>\n<li>Navigate to <strong>Backup &gt; Backup Configuration<\/strong>.<\/li>\n<li>Enable <strong>Scheduled Backups<\/strong> (Daily incremental).<\/li>\n<li>Under the <strong>Additional Destinations<\/strong> tab, connect an S3-compatible cloud storage bucket (Cloudflare R2, AWS S3, or Wasabi).<\/li>\n<li>Ensure system files (<code>\/etc\/<\/code>) and MySQL databases are included in the archive.<\/li>\n<\/ol>\n<h2>10. Enable Tweak Settings Security Directives<\/h2>\n<p>Navigate to <strong>Server Configuration &gt; Tweak Settings<\/strong> and enable these vital safeguards:<\/p>\n<ul>\n<li><em>Prevent &#8216;nobody&#8217; from sending mail:<\/em> <strong>On<\/strong> (Stops rogue scripts from sending unauthenticated spam).<\/li>\n<li><em>Reset password for cPanel accounts:<\/em> Require strong passwords (minimum strength score 80).<\/li>\n<li><em>Cookie IP Validation:<\/em> <strong>Strict<\/strong> (Prevents session hijacking if an administrative session cookie is stolen).<\/li>\n<\/ul>\n<h2>Automated Server Health Monitoring &amp; Mail Queue Triage in WHM<\/h2>\n<p>Maintaining high availability across multi-tenant cPanel servers requires real-time health monitoring and automated queue maintenance:<\/p>\n<ul>\n<li><strong>Automating Service Recovery via ChkServd:<\/strong> WHM includes a native monitoring daemon named <strong>ChkServd<\/strong>. Navigate to <strong>Service Configuration &gt; Service Manager<\/strong> and ensure monitoring and automated restart checkboxes are enabled for:\n<ul>\n<li><code>cpsrvd<\/code> (cPanel\/WHM web service)<\/li>\n<li><code>httpd<\/code> (Apache \/ OpenLiteSpeed)<\/li>\n<li><code>mysql<\/code> (MariaDB database daemon)<\/li>\n<li><code>exim<\/code> (SMTP mail transfer agent)<\/li>\n<li><code>named<\/code> (BIND \/ PowerDNS nameserver)<\/li>\n<\/ul>\n<p>    If any service deadlocks or terminates unexpectedly, ChkServd automatically revives the process within 60 seconds and emails an incident diagnostic report to the root administrator.<\/li>\n<li><strong>Managing the Exim Outbound Mail Queue:<\/strong> Prevent backlogged email queues using the Exim command-line interface via terminal:\n<pre><code># View current queue count\nexim -bpc\n\n# Inspect top sender domains currently sending mail\nexim -bp | exiqsumm\n\n# Purge frozen spam messages from the queue immediately\nexiqgrep -z -i | xargs exim -Mrm<\/code><\/pre>\n<\/li>\n<li><strong>Automating Daily Security Scans with ClamAV \/ Maldet:<\/strong> Deploy <strong>Linux Malware Detect (LMD \/ Maldet)<\/strong> alongside ClamAV to automatically scan newly uploaded files inside <code>\/home\/*\/public_html<\/code> every night, automatically quarantining suspicious web shells.<\/li>\n<\/ul>\n<div style=\"background: linear-gradient(135deg, #0f172a 0%, #1e293b 100%);border: 1px solid #334155;border-radius: 12px;padding: 28px;margin: 36px 0;text-align: center\">\n<h3 style=\"color: #38bdf8;margin-top: 0;font-size: 22px\">Launch Enterprise WHM Infrastructure on CpanelFree<\/h3>\n<p style=\"color: #cbd5e1;font-size: 16px;line-height: 1.6;max-width: 680px;margin: 12px auto 24px auto\">Run hardened, production-ready cPanel &amp; WHM servers with dedicated NVMe storage, lightning-fast network ports, and hardware DDoS mitigation with CpanelFree.<\/p>\n<p>    <a href=\"https:\/\/cpanelfree.com\/\" style=\"background: #38bdf8;color: #0f172a;font-weight: 700;padding: 12px 28px;border-radius: 6px;text-decoration: none;display: inline-block;font-size: 15px\">Discover CpanelFree Cloud VPS Plans &rarr;<\/a>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Installing cPanel &amp; WHM on a freshly provisioned Linux server takes less than twenty minutes, but launching production websites on a default, unhardened WHM installation is an invitation to disaster. Out of the box, WHM operates with permissive firewall policies, disabled brute-force protections, default PHP compile profiles, and unconfigured email deliverability standards on a Linux &#8230; <a title=\"Initial WHM Server Setup Checklist: 10 Critical Steps After Installing cPanel\/WHM\" class=\"read-more\" href=\"https:\/\/cpanelfree.com\/blog\/initial-whm-server-setup-checklist-guide\/\" aria-label=\"Read more about Initial WHM Server Setup Checklist: 10 Critical Steps After Installing cPanel\/WHM\">Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":4436,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-4437","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-web-hosting-news"],"_links":{"self":[{"href":"https:\/\/cpanelfree.com\/blog\/wp-json\/wp\/v2\/posts\/4437","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cpanelfree.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cpanelfree.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cpanelfree.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cpanelfree.com\/blog\/wp-json\/wp\/v2\/comments?post=4437"}],"version-history":[{"count":1,"href":"https:\/\/cpanelfree.com\/blog\/wp-json\/wp\/v2\/posts\/4437\/revisions"}],"predecessor-version":[{"id":4452,"href":"https:\/\/cpanelfree.com\/blog\/wp-json\/wp\/v2\/posts\/4437\/revisions\/4452"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cpanelfree.com\/blog\/wp-json\/wp\/v2\/media\/4436"}],"wp:attachment":[{"href":"https:\/\/cpanelfree.com\/blog\/wp-json\/wp\/v2\/media?parent=4437"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cpanelfree.com\/blog\/wp-json\/wp\/v2\/categories?post=4437"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cpanelfree.com\/blog\/wp-json\/wp\/v2\/tags?post=4437"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}