cPanel Shared Hosting Security Checklist: 12 Steps to Harden Your Website

Shared hosting is a trade-off: you get affordable infrastructure managed by your hosting provider, but your account security is still entirely your responsibility. A compromised cPanel account can mean malware injected into your website, email accounts used for spam, and data accessible to attackers. This checklist covers the 12 most important steps to harden your cPanel hosting account — most take under five minutes.

1. Use a Strong, Unique cPanel Password

Your cPanel password is the master key to your entire hosting account. If it is compromised, an attacker has access to every file, database, email account, and DNS record on your account.

• Use a minimum of 16 characters, combining letters, numbers, and symbols.
• Never reuse a password from another service. If that service is breached, your hosting account is next.
• Use a password manager (Bitwarden, 1Password) to generate and store the password.
• Change your cPanel password immediately if you have ever shared it with someone (a developer, an agency, a previous employee).

To change your cPanel password: log in to cPanel → top-right user menu → Password & Security.

2. Enable Two-Factor Authentication (2FA) on cPanel

Two-factor authentication adds a time-based one-time password (TOTP) requirement on top of your cPanel password. Even if your password is compromised, an attacker cannot log in without your phone.

1. In cPanel, search for Two-Factor Authentication or find it under Security
2. Click Set Up Two-Factor Authentication
3. Scan the QR code with Google Authenticator, Authy, or any TOTP app
4. Enter the 6-digit code to confirm and activate

Store your backup codes in a safe place. If you lose access to your authenticator app without backup codes, you will be locked out of your account.

3. Disable Unused Email Accounts and Forwarders

Every active email account on your hosting is a potential entry point. Old accounts from previous employees, clients, or projects — especially ones with weak passwords — can be brute-forced and used to send spam.

• Review all email accounts: cPanel → Email Accounts. Delete any account that is no longer needed.
• Review email forwarders: cPanel → Forwarders. Remove any forwarding rules pointing to addresses you do not control.
• Check the email account passwords — if any are weak (under 12 characters, dictionary words), update them now.

4. Enable DKIM, SPF, and DMARC for All Domains

These three DNS records protect your domain from being used in email spoofing and phishing attacks. Without them, anyone can send email that appears to come from your domain.

• DKIM: cPanel → Email → Email Deliverability. Click Manage next to your domain and verify DKIM is active.
• SPF: Same page — verify the SPF record is installed and correct.
• DMARC: Usually not set automatically by cPanel. Add a DNS TXT record manually:

# DMARC record — add in cPanel Zone Editor
Name:  _dmarc.yourdomain.com
Type:  TXT
Value: "v=DMARC1; p=quarantine; rua=mailto:[email protected]; pct=100"

# 'p=quarantine' means suspicious emails go to spam.
# 'p=reject' is stricter — rejects suspicious emails entirely.
# Start with quarantine and move to reject after monitoring.

5. Set Correct File Permissions

Incorrect file permissions are one of the most common ways malware spreads between websites on shared hosting. Overly permissive files (777) allow any process on the server to read, write, or execute them.

The correct permissions for WordPress and most PHP applications:

# Directories: 755 (owner can write, others can read and execute)
find /home/user/public_html -type d -exec chmod 755 {} ;

# Files: 644 (owner can write, others can read only)
find /home/user/public_html -type f -exec chmod 644 {} ;

# wp-config.php: 400 (owner read-only, no one else)
chmod 400 /home/user/public_html/wp-config.php

Never set directories or files to 777 unless absolutely required by a specific application, and even then only temporarily.

6. Enable ModSecurity (Web Application Firewall)

ModSecurity is a web application firewall (WAF) that filters malicious HTTP requests before they reach your website. It blocks common attacks including SQL injection, XSS, and file inclusion exploits.

On cPanel with WHM access, ModSecurity can be managed per-account. If you are on shared hosting, contact your provider to confirm ModSecurity is enabled — most reputable shared hosts enable it by default.

To check if ModSecurity is active on your account: cPanel → Security → look for ModSecurity. Toggle it on for your domains if available.

7. Keep PHP Version Updated

Running an outdated PHP version is a significant security risk. Older PHP versions no longer receive security patches, meaning known vulnerabilities remain permanently unpatched on your server.

• Go to cPanel → MultiPHP Manager
• Check the PHP version assigned to each domain
• Update to the latest stable version your applications support. As of 2026, PHP 8.2 and 8.3 are the actively maintained versions. PHP 7.4 is end-of-life.
• Before changing PHP version, test your website — some older plugins or applications may have compatibility issues with newer PHP.

8. Regularly Scan for Malware

Even with strong passwords and good hygiene, websites on shared hosting can be compromised through vulnerable plugins, themes, or applications. Regular malware scanning catches infections early.

• Imunify360 — Many cPanel hosts include this commercial antivirus/ malware scanner. Look for it under cPanel → Imunify360 orSecurity.
• ClamAV — Open-source antivirus often available on cPanel. Run via SSH: clamscan -r /home/user/public_html
• Wordfence (WordPress-specific) — Install as a plugin for real-time malware scanning and firewall protection.

9. Disable Directory Listing

By default, if a directory does not have an index file (index.html, index.php), Apache will display a list of all files in that directory. This exposes your file structure to anyone who knows the URL — including sensitive files you may not have intended to be public.

Add this to your .htaccess file to disable directory listing globally:

Options -Indexes

Or enable it site-wide: cPanel → Indexes → select your directory → choose No Indexing.

10. Enable SSL/HTTPS on All Domains

Every domain on your hosting account should use HTTPS — not just the main one. Subdomains, staging environments, and development domains are common attack surfaces that are often overlooked.

• Go to cPanel → SSL/TLS Status
• Run AutoSSL on any domain showing a yellow or red status
• Enable Force HTTPS Redirect for each domain after SSL is installed: cPanel → Domains → toggle Force HTTPS

11. Review and Restrict Hotlink Protection

Hotlinking is when another website embeds your images or files directly from your server URL, using your bandwidth without your permission. Beyond the cost, it can also be a vector for content scraping.

Enable hotlink protection: cPanel → Security → Hotlink Protection. Add your own domains to the allowed list and block external requests for your image and media files.

12. Check and Remove Suspicious Cron Jobs

Malware frequently installs cron jobs to maintain persistence — re-infecting files even after you manually clean them. Regularly review scheduled tasks on your account.

In cPanel: Advanced → Cron Jobs. Review every entry and remove any you do not recognise.

Via SSH:

# View all cron jobs for current user
crontab -l

# Look for suspicious patterns:
# - wget/curl downloading scripts from external URLs
# - base64-encoded commands
# - references to /tmp/ directory
# - obfuscated PHP execution

A legitimate cron job entry looks like a scheduled task you set up intentionally. If you see a command that downloads something from an unfamiliar URL or executes encoded commands, remove it and perform a full malware scan.

Security Checklist Summary

1. Strong, unique cPanel password (16+ characters)
2. Two-factor authentication enabled on cPanel
3. Unused email accounts and forwarders deleted
4. DKIM, SPF, and DMARC configured for all domains
5. File permissions: directories 755, files 644, wp-config.php 400
6. ModSecurity (WAF) enabled
7. PHP version updated to a supported release (8.2 or 8.3)
8. Malware scan completed and clean
9. Directory listing disabled
10. SSL active and HTTPS redirect enabled on all domains
11. Hotlink protection enabled
12. Cron jobs reviewed — no suspicious entries

Conclusion

None of these steps are difficult or expensive — most take under five minutes each. The risk of skipping them, however, is significant: a compromised hosting account affects every website on it, your email reputation, and potentially your clients or customers. Run through this checklist today, then schedule a quarterly review to keep your account hardened as your setup evolves.