Use layered security rather than relying on one control.
- Use a unique, strong cPanel password.
- Enable cPanel 2FA when available.
- Keep websites and applications updated.
- Remove unused FTP, SSH, API, application, and directory-authentication credentials.
- Use HTTPS with valid certificates.
- Leave ModSecurity enabled unless temporarily testing a confirmed rule conflict.
- Protect SSH and SSL private keys.
- Review unfamiliar files and account changes before deleting or modifying them.
- Maintain recoverable backups before major security or configuration changes.
Security controls reduce risk; none of them can guarantee that an account or application will never be compromised.
