WebHost Manager (WHM) grants access to powerful server functions that can affect all cPanel users. A root user may go between configuring ConfigServer Security & Firewall (CSF) rules, resetting a cPanel user password, backing up data, and ImunifyAV file scans in one session.
This power, combined with the fact that cPanel is one of the most popular Linux server management applications, makes an enticing target for malicious users to learn how to hack cPanel websites and servers.
For websites, you can add security HTTP headers in your .htaccess file to protect viewers from malware and spyware if your server is infected. You can do the same in WHM to protect important cPanel service deamons (cpsrvd) for applications such as cPHulk, PHP-FPM, and ClamAV. [A daemon is a program that runs as a background process.]
Below we will cover how to secure cPanel Service Daemons in WHM via:
- How to Secure cPanel with Content-Security-Policy (CSP)
- How to Secure cPanel with X-Frame-Options and X-Content-Type-Options
How to Secure cPanel with Content-Security-Policy (CSP)
Content Security Policy (CSP) can prevent cross-site scripting (XSS) attacks with cpsrvd by only allowing whitelisted sources to load and disallowing JavaScript from external sites.
- Log into WHM
- Select Tweak Settings
- Search for “header” and select On beside Enable Content-Security-Policy on some interfaces
- At the bottom, select Save
Enjoy high-performance, lightning-fast servers with increased security and maximum up-time with our Secure VPS Hosting!
Linux VPS cPanel or Control Web Panel Scalable Website Migration Assistance
How to Secure cPanel with X-Frame-Options and X-Content-Type-Options
X-Frame-Options, with the SAMEORIGIN directive, forces the browser to only allow elements from your cPanel instance to be embedded within itself using the <frame>, <iframe>, or <object> tags to prevent clickjacking attacks.
X-Content-Type-Options, with the NOSNIFF directive, forces the browser to only use the indicated MIME type for files on the server to prevent MIME sniffing.
- Log into WHM
- Select Tweak Settings
- Search for “header” and select On beside Use X-Frame-Options and X-Content-Type-Options headers with cpsrvd
- At the bottom, select Save
Now you’ve learned how to secure cPanel Service Daemons in WHM, but Is cPanel secure? Audit your VPS with our article on how to harden Managed VPS Hosting. Learn even more from our Managed VPS Hosting Product Guide.
