As a reseller, a security lapse doesn’t just affect you — it affects every client account under your WHM. These are the settings worth configuring early.
Strong authentication on your own WHM login
Use a long, unique password for your WHM account, and enable two-factor authentication if your plan/provider supports it (Security Center > Two-Factor Authentication in WHM). Your WHM login has more reach than any single client’s cPanel — protect it accordingly.
Restricting WHM access by IP
If you always manage WHM from the same location(s) — a home/office IP, a VPN — restrict access under Security Center > Host Access Control so WHM’s login page isn’t even reachable from unrecognized IPs, cutting off most automated attack attempts before they reach a login prompt at all.
Password policy for client accounts
Under Security Center > Password Strength Configuration, set a reasonable minimum password strength requirement so new client accounts (and any password resets) aren’t left with a trivially weak password by default.
Keeping cPanel/WHM itself updated
Confirm automatic updates are enabled (cPanel Update Preferences, if you have access to this on your reseller plan) so security patches for cPanel/WHM itself apply without manual intervention — most compromises exploit known, already-patched vulnerabilities.
Monitoring for compromised accounts
Keep an eye on unusual resource usage across your client accounts (Resource Usage stats, per-account) — a sudden spike in outgoing email or CPU on one account is a common early sign of a compromised WordPress install or a hijacked script sending spam, and catching it early limits the blast radius to that one account rather than your server’s IP reputation as a whole.
A reasonable baseline
None of these settings require deep security expertise — strong auth, IP restriction where practical, a sane password policy, and staying updated cover the overwhelming majority of real-world reseller account compromises.