Running WordPress on cPanel gives you powerful server-level controls alongside familiar web hosting tools. But with that power comes responsibility—misconfigurations, outdated software, and weak security practices can turn a fast site into a compromised liability. This checklist walks you through advanced setup, hardening, and maintenance tasks that separate professional deployments from default installs.
Use this as a living document. Not every item applies to every site, but each one addresses a real operational concern I've seen in production environments.
Pre-Installation: Foundation Checks
Before you click the WordPress installer, verify your hosting environment is configured correctly.
Verify PHP version and extensions
- Confirm PHP version is actively supported (check the official PHP release cycle)
- Required extensions:
mysqli,json,openssl,curl,mbstring,xml,zip,gdorimagick - In cPanel MultiPHP Manager, set the account or domain to the recommended PHP version
- Disable deprecated extensions like
mcryptthat trigger warnings
Check database configuration
- Use InnoDB storage engine (default in modern MySQL/MariaDB)
- Verify
max_allowed_packetis at least 64M for imports - Confirm database user has only necessary privileges—avoid GRANT ALL when possible
- Test remote access is disabled unless specifically required
Set proper file permissions before install
find /home/username/public_html -type d -exec chmod 755 {} \;
find /home/username/public_html -type f -exec chmod 644 {} \;
Never use 777 permissions. If WordPress reports write errors, check ownership instead.
Installation & Initial Hardening
Use WP-CLI instead of Softaculous when possible
WP-CLI gives you reproducible, scriptable installs with no bloat.
cd ~/public_html
wp core download
wp config create --dbname=dbname --dbuser=dbuser --dbpass='password'
wp core install --url=example.com --title="Site Title" --admin_user=admin [email protected]
If WP-CLI isn't available, request it from your host or use Softaculous but immediately remove any bundled themes or plugins you don't need.
Generate unique authentication keys and salts
Replace the placeholder salts in wp-config.php with fresh values. Visit the WordPress.org secret-key service or generate them via WP-CLI:
wp config shuffle-salts
This invalidates all active sessions—useful for forcing re-authentication after a breach.
Move wp-config.php one directory up
WordPress allows wp-config.php to live one directory above the web root. Move it there to reduce exposure:
mv ~/public_html/wp-config.php ~/wp-config.php
WordPress will find it automatically. Verify with wp config path.
Disable file editing from dashboard
Add this to wp-config.php before the "stop editing" comment:
define('DISALLOW_FILE_EDIT', true);
This removes the theme and plugin editors from the admin panel, reducing attack surface if credentials are compromised.
Change the database table prefix
The default wp_ prefix is a minor security-by-obscurity win. Change it during install or after with WP-CLI:
wp db export backup.sql
wp db prefix new_prefix_
Verify the change with wp db tables before deleting the backup.
Security Hardening Checklist
Protect wp-login.php
Brute force attacks target this page relentlessly. Use cPanel IP Blocker, Cloudflare Access Rules, or add rate limiting in .htaccess:
<Files wp-login.php>
Require ip 203.0.113.0/24
</Files>
Replace with your office or VPN IP range. For broader access, implement two-factor authentication via plugin.
Hide the WordPress version
Version disclosure helps attackers identify vulnerable installs. Add to your theme's functions.php:
remove_action('wp_head', 'wp_generator');
add_filter('the_generator', '__return_empty_string');
Disable XML-RPC if not needed
XML-RPC enables the mobile app and remote publishing but is a frequent attack vector. Disable it unless you specifically use those features:
# In .htaccess
<Files xmlrpc.php>
Require all denied
</Files>
Or use a plugin like Disable XML-RPC.
Implement Content Security Policy headers
Add CSP headers via .htaccess to mitigate XSS:
<IfModule mod_headers.c>
Header set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline';"
</IfModule>
Adjust directives based on your plugins and CDN usage. Test thoroughly—overly restrictive policies break functionality.
Scan for malware regularly
Use ClamAV from the command line or install a security plugin that scans file integrity. Check for:
- Modified core files (
wp core verify-checksums) - Suspicious files in uploads directory
- Base64-encoded eval statements in PHP files
- Unexpected admin users (
wp user list --role=administrator)
Review user accounts and roles
wp user list --fields=ID,user_login,user_email,roles
Remove old admin accounts, demote users to Editor or Author where appropriate, and enforce strong password policies.
Performance Optimization
Enable OPcache
Verify OPcache is enabled in cPanel MultiPHP INI Editor:
opcache.enable=1
opcache.memory_consumption=128
opcache.interned_strings_buffer=8
opcache.max_accelerated_files=10000
opcache.revalidate_freq=2
Check status with php -i | grep opcache or a plugin like OPcache Dashboard.
Configure object caching
Redis or Memcached dramatically improve database-heavy sites. If your cPanel host provides Redis:
wp plugin install redis-cache --activate
wp redis enable
Verify with wp redis status. For Memcached, use the W3 Total Cache or LiteSpeed Cache plugin.
Optimize the database
Clean up post revisions, transients, and orphaned metadata:
wp transient delete --all
wp db optimize
Schedule this monthly via cron:
0 3 1 * * cd /home/username/public_html && wp transient delete --all && wp db optimize
Enable Gzip compression
Add to .htaccess if not already enabled:
<IfModule mod_deflate.c>
AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript
</IfModule>
Verify with browser dev tools or an online compression checker.
Lazy load images
Native lazy loading is built into WordPress core for recent versions. Ensure your images include the loading="lazy" attribute or use a plugin for older installs.
Implement a CDN
Cloudflare is the most accessible option for cPanel users. Point your domain's nameservers to Cloudflare, enable caching, and configure page rules for static assets. Use the Cloudflare plugin to purge cache automatically when content changes.
Backup & Disaster Recovery
Verify cPanel backups are running
Check cPanel Backup interface to confirm:
- Full backups scheduled (weekly minimum)
- Backup destination is off-server (remote FTP, S3, or Google Drive)
- Retention policy meets your recovery point objective
Implement application-level backups
Don't rely solely on cPanel backups. Use a plugin like UpdraftPlus or BackWPup configured to:
- Back up files and database separately
- Store copies in remote storage (S3, Dropbox, Google Drive)
- Encrypt backups containing sensitive data
- Test restoration quarterly—untested backups are not backups
Document restoration procedure
Write a runbook that includes:
- Database restoration commands (
wp db import backup.sql) - File extraction steps
- DNS cutover process if restoring to a new server
- Contact information for hosting support
Store this outside your hosting account—a compromised server can't provide the documentation you need to recover from it.
Maintenance & Monitoring
Automate core, plugin, and theme updates
For stable sites, enable automatic minor updates:
// In wp-config.php
define('WP_AUTO_UPDATE_CORE', 'minor');
For plugins, use WP-CLI in a cron job:
0 4 * * * cd /home/username/public_html && wp plugin update --all
Always test on a staging site first for major updates.
Monitor uptime and SSL expiry
Use external monitoring services to alert you when:
- Site returns non-200 status codes
- Response time exceeds threshold
- SSL certificate expires within 30 days
cPanel AutoSSL handles Let's Encrypt renewals automatically, but verify it's enabled and check for certificate errors in the interface.
Review error logs weekly
Check cPanel Error Log for:
- PHP fatal errors and warnings
- Failed login attempts (check access logs for brute force patterns)
- Plugin conflicts or deprecated function calls
Address warnings before they become critical failures.
Keep PHP and MySQL updated
cPanel makes this easy—just change the version in MultiPHP Manager. Before upgrading:
- Check plugin and theme compatibility
- Test on staging
- Schedule during low-traffic windows
- Keep previous version available for quick rollback
Audit installed plugins quarterly
Remove:
- Plugins inactive for more than 90 days
- Plugins with unpatched security vulnerabilities
- Plugins abandoned by developers (no updates in 2+ years)
- Overlapping plugins that duplicate functionality
Every plugin is attack surface. Keep only what you actively use.
Advanced cPanel-Specific Tasks
Use cPanel staging features
If your host offers staging (common in cPanel versions with JetBackup integration), use it for:
- Testing major WordPress updates
- Trying new plugins without risk
- Debugging issues by comparing staging vs. production
Push changes to production only after validation.
Optimize Apache with .htaccess caching headers
<IfModule mod_expires.c>
ExpiresActive On
ExpiresByType image/jpg "access plus 1 year"
ExpiresByType image/jpeg "access plus 1 year"
ExpiresByType image/png "access plus 1 year"
ExpiresByType text/css "access plus 1 month"
ExpiresByType application/javascript "access plus 1 month"
</IfModule>
Test with browser dev tools to confirm cache headers are sent.
Configure resource limits appropriately
In cPanel Select PHP Version (or MultiPHP INI Editor), increase limits for production sites:
memory_limit = 256M
max_execution_time = 300
post_max_size = 64M
upload_max_filesize = 64M
Balance between functionality and preventing runaway processes from consuming resources.
Enable Hotlink Protection
In cPanel Hotlink Protection, prevent other sites from embedding your images:
- Enable protection
- Add allowed domains (your CDN, social media platforms)
- Specify redirect URL or serve a placeholder image
This saves bandwidth and prevents content theft.
Conclusion
Advanced WordPress management on cPanel is about discipline—establishing secure defaults, automating routine tasks, and monitoring continuously. Work through this checklist methodically when setting up new sites, then return to it quarterly for maintenance sweeps. The operational maturity you build prevents the late-night emergencies that come from deferred maintenance and security neglect. Bookmark this page, adapt it to your environment, and treat it as a living document that evolves with your infrastructure.