What SSL/TLS and HTTPS Do for a Website SSL/TLS encrypts traffic between a client and a server. For websites, this is what allows a... How to Change Your cPanel Account Password Use cPanel → Preferences → Password & Security to change the cPanel account password. Current... How to Update WordPress Using WP Toolkit Keeping WordPress core, plugins, and themes current is an important part of maintaining a secure... Should You Include Integration Links in a Full cPanel Backup? Some current cPanel full-backup screens offer an Include integration links option. cPanel warns... How to Check WordPress Core File Integrity with WP Toolkit WP Toolkit can compare WordPress core files with the expected files for the installed WordPress... Understanding SSL Private Keys in cPanel An SSL private key is the secret half of the public/private key pair used by a certificate. It... Diagnosing Website File Permission Errors Linux permissions control which users and processes can read, write, or execute files and... How to Protect SSL Private Keys Treat an SSL private key like a high-value credential. Do not paste it into public tickets, chat... How to Configure Automatic WordPress Updates in WP Toolkit WP Toolkit can configure automatic updates separately for WordPress core, plugins, and themes.... How to Apply WordPress Security Hardening with WP Toolkit Deluxe WP Toolkit Deluxe: cPanel lists one-click hardening, automatic hardening, multiple hardening, and... How GnuPG Email Encryption Works in cPanel cPanel's Encryption interface can create and manage GnuPG keys for public-key encryption... Email Security: Passwords, Phishing, and Safe Account Use Email accounts are frequent targets for password theft and social-engineering attacks. A few... Understanding HTTP-to-HTTPS Redirects After SSL Is Installed An SSL certificate allows HTTPS, but it does not automatically guarantee that every HTTP request... How Security Rollback Works in WP Toolkit Deluxe WP Toolkit Deluxe: cPanel's current feature matrix lists Security Rollback as a Deluxe... What Is Directory Privacy in cPanel? Directory Privacy adds web authentication to a selected directory. Visitors who request protected... How to Password-Protect a Directory in cPanel Use cPanel → Files → Directory Privacy when the feature is enabled. Navigate to the directory and... How to Manage Directory Privacy Users After enabling Directory Privacy, create users who are allowed to authenticate to the protected... Understanding Directory Privacy Inheritance A directory protected through cPanel Directory Privacy also protects its subdirectories through... What Is DNSSEC and When Is It Used? DNSSEC (Domain Name System Security Extensions) adds cryptographic signatures to DNS data so... How to Block an IP Address from Website Access in cPanel Use cPanel → Security → IP Blocker to deny web access from selected IP addresses, ranges, or... What cPanel IP Blocker Does and Does Not Block cPanel's IP Blocker controls access to websites served by the account. It is not a server-wide... How to Remove an IP Block in cPanel To restore website access for an address previously blocked through cPanel: Open Security → IP... What Is Hotlink Protection in cPanel? A hotlink occurs when another website embeds a file from your site and your server supplies that... How to Configure Hotlink Protection Open cPanel → Security → Hotlink Protection when the feature is enabled. Enable hotlink... How to Disable Hotlink Protection Safely Before disabling Hotlink Protection, save a copy of the allowed-referrer list if you may need it... How to Recreate or Remove a cPanel Dynamic DNS URL If a Dynamic DNS webcall URL is exposed or no longer needed, cPanel can recreate or remove it.... What Is Leech Protection in cPanel? Leech Protection works with password-restricted directories to detect unusually frequent logins... How to Configure Leech Protection Use cPanel → Security → Leech Protection for a directory that already uses or will use Directory... Leech Protection and LiteSpeed Compatibility Current cPanel documentation states that LiteSpeed Web Server does not support cPanel Leech... What Is ModSecurity in cPanel? ModSecurity is a web application firewall engine that applies configured security rules to web... How to Enable or Disable ModSecurity for a Domain When the interface is available, open cPanel → Security → ModSecurity. You can enable or disable... Troubleshooting a Possible ModSecurity 403 Error A blocked web request can sometimes appear as a 403 error, but not every 403 is caused by... How to Enable Two-Factor Authentication for cPanel When two-factor authentication is enabled on the server, cPanel can require both the account... How to Reconfigure or Remove cPanel Two-Factor Authentication Use the Two-Factor Authentication interface to replace an existing authenticator configuration or... How to Protect cPanel Backup Files Backup archives can contain highly sensitive information, including website source files,... Troubleshooting Invalid cPanel 2FA Codes Time-based 2FA codes depend on accurate time. If cPanel reports that a current code is invalid:... Understanding cPanel Security Policy Questions and Verified IPs The Security Policy interface can appear when the server is configured to use security questions... How to Rotate a DNSSEC Key Safely DNSSEC keys can be rotated periodically so a domain does not rely indefinitely on the same... Understanding SSH Access in cPanel SSH provides encrypted command-line access to a hosting account when shell access is enabled.... How to Generate an SSH Key Pair in cPanel Use cPanel → Security → SSH Access → Manage SSH Keys to create a key pair. Select Generate a New... How to Import and Authorize an SSH Key in cPanel Existing SSH keys can be imported through SSH Access → Manage SSH Keys → Import Key. Choose a key... How to Keep SSH Private Keys Secure An SSH private key can authenticate access without typing the account password, so it must be... How to Deauthorize or Delete an SSH Key in cPanel Use SSH Access → Manage SSH Keys to remove access associated with an old key. Deauthorize the... What Are cPanel API Tokens? cPanel API tokens allow scripts or external tools to run supported cPanel API functions without... How to Create a cPanel API Token When enabled, open cPanel → Security → Manage API Tokens. Select Create.Enter a unique token... How cPanel API Token Expiration Works A cPanel API token can be created with no expiration or with a specific expiration date. Current... How to Revoke a cPanel API Token Revoke an API token when an integration is retired, the token may have been exposed, or access is... Why API Tokens Are Better Than cPanel Passwords for Automation For unattended API automation, use an API token instead of embedding the cPanel account... Choosing Safer Website File and Directory Permissions Filesystem permissions determine which users and processes can read, write, or execute files. Use... Understanding Security Rules in .htaccess Files An .htaccess file can contain directory-level Apache configuration such as redirects,... Why Some cPanel Security Tools May Not Appear Many cPanel security interfaces are controlled by the server's Feature Manager and account... A Practical cPanel Account Security Checklist Use layered security rather than relying on one control. Use a unique, strong cPanel... Checklist Before Making SSL or Security Changes Before changing a live website's certificate or security configuration: Identify the exact domain...