---
title: "How to Secure cPanel Service Daemons (cpsrvd) in WHM"
description: "WebHost Manager (WHM) grants access to powerful server functions that can affect all cPanel users. A root user may go between configuring ConfigServer Security & Firewall (CSF) rules, resetting a..."
url: https://www.inmotionhosting.com/support/product-guides/vps-hosting/secure-cpanel-service-daemons-in-whm/
date: 2020-06-16
modified: 2023-11-03
author: "InMotion Hosting Contributor"
categories: ["VPS Hosting"]
type: post
lang: en
---

# How to Secure cPanel Service Daemons (cpsrvd) in WHM

![How to Secure cPanel Service Daemons (cpsrvd) in WHM Hero Image](https://www.inmotionhosting.com/support/wp-content/uploads/2023/11/How-to-Secure-cPanel-Service-Daemons-in-WHM-1024x538.png)

**WebHost Manager (WHM)** grants access to powerful server functions that can affect all cPanel users. A root user may go between configuring ConfigServer Security & Firewall (CSF) rules, resetting a cPanel user password, backing up data, and ImunifyAV file scans in one session.

This power, combined with the fact that cPanel is one of the most popular Linux server management applications, makes an enticing target for malicious users to learn how to hack cPanel websites and servers.

For websites, you can add security HTTP headers in your .htaccess file to protect viewers from malware and spyware if your server is infected. You can do the same in WHM to protect important [cPanel service deamons (cpsrvd)](https://docs.cpanel.net/knowledge-base/cpanel-product/the-cpanel-service-daemons/) for applications such as [cPHulk](https://www.inmotionhosting.com/support/edu/whm/enable-cphulk-brute-force-protection/), PHP-FPM, and ClamAV. [*A daemon is a program that runs as a background process*.]

Below we will cover how to secure cPanel Service Daemons in WHM via:

- [How to Secure cPanel with Content-Security-Policy (CSP)](#csp)
- [How to Secure cPanel with X-Frame-Options and X-Content-Type-Options](#x-options)

## How to Secure cPanel with Content-Security-Policy (CSP)

**Content Security Policy (CSP)** can prevent cross-site scripting (XSS) attacks with cpsrvd by only allowing whitelisted sources to load and disallowing JavaScript from external sites.

1. Log into WHM
2. Select **Tweak Settings**
3. Search for “header” and select *On* beside **Enable Content-Security-Policy on some interfaces**
4. At the bottom, select **Save**

![How to secure cPanel with security HTTP headers](https://www.inmotionhosting.com/support/wp-content/uploads/2020/06/whm-http-headers-1024x297.png)

![Secure VPS Hosting](https://design.inmotionhosting.com/assets/icons/custom/security.svg)Enjoy high-performance, lightning-fast servers with increased security and maximum up-time with our [Secure VPS Hosting](https://www.inmotionhosting.com/vps-hosting)!

![check mark](https://design.inmotionhosting.com/assets/icons/standard/check-blue.svg)Linux VPS ![check mark](https://design.inmotionhosting.com/assets/icons/standard/check-blue.svg)cPanel or Control Web Panel ![check mark](https://design.inmotionhosting.com/assets/icons/standard/check-blue.svg)Scalable ![check mark](https://design.inmotionhosting.com/assets/icons/standard/check-blue.svg)Website Migration Assistance

[Linux VPS Hosting](https://www.inmotionhosting.com/vps-hosting/linux-vps)

## How to Secure cPanel with X-Frame-Options and X-Content-Type-Options

**X-Frame-Options**, with the `SAMEORIGIN` directive, forces the browser to only allow elements from your cPanel instance to be embedded within itself using the `<frame>`, `<iframe>`, or `<object>` tags to prevent clickjacking attacks.

**X-Content-Type-Options**, with the `NOSNIFF` directive, forces the browser to only use the indicated MIME type for files on the server to prevent MIME sniffing.

1. Log into WHM
2. Select **Tweak Settings**
3. Search for “header” and select *On* beside **Use X-Frame-Options and X-Content-Type-Options headers with cpsrvd**
4. At the bottom, select **Save**

Now you’ve learned how to secure cPanel Service Daemons in WHM, but Is cPanel secure? Audit your VPS with our article on [how to harden Managed VPS Hosting](https://www.inmotionhosting.com/support/product-guides/vps-hosting/ways-to-harden-your-vps-hosting/). Learn even more from our [Managed VPS Hosting Product Guide](https://www.inmotionhosting.com/support/product-guides/vps-hosting/).