WHM Security Settings Every Reseller Should Configure

As a reseller, a security lapse doesn’t just affect you — it affects every client account under your WHM. These are the settings worth configuring early.

Strong authentication on your own WHM login

Use a long, unique password for your WHM account, and enable two-factor authentication if your plan/provider supports it (Security Center > Two-Factor Authentication in WHM). Your WHM login has more reach than any single client’s cPanel — protect it accordingly.

Restricting WHM access by IP

If you always manage WHM from the same location(s) — a home/office IP, a VPN — restrict access under Security Center > Host Access Control so WHM’s login page isn’t even reachable from unrecognized IPs, cutting off most automated attack attempts before they reach a login prompt at all.

Password policy for client accounts

Under Security Center > Password Strength Configuration, set a reasonable minimum password strength requirement so new client accounts (and any password resets) aren’t left with a trivially weak password by default.

Keeping cPanel/WHM itself updated

Confirm automatic updates are enabled (cPanel Update Preferences, if you have access to this on your reseller plan) so security patches for cPanel/WHM itself apply without manual intervention — most compromises exploit known, already-patched vulnerabilities.

Monitoring for compromised accounts

Keep an eye on unusual resource usage across your client accounts (Resource Usage stats, per-account) — a sudden spike in outgoing email or CPU on one account is a common early sign of a compromised WordPress install or a hijacked script sending spam, and catching it early limits the blast radius to that one account rather than your server’s IP reputation as a whole.

A reasonable baseline

None of these settings require deep security expertise — strong auth, IP restriction where practical, a sane password policy, and staying updated cover the overwhelming majority of real-world reseller account compromises.