A browser error page tells you something went wrong; the logs tell you why. cPanel gives you three sources: the web server Errors log, PHP error_log files written next to your scripts, and Raw Access logs with every request. Checking them first saves a lot of guessing.
Before you start
- Reproduce the problem (load the failing page) just before you look, so the newest entries are relevant.
- Note the time and the URL.
The Errors tool
- Open cPanel → Metrics → Errors.
- It shows the last 300 web server error messages for your account, newest first.
Typical lines and what they mean:
| Log text | Meaning |
|---|---|
client denied by server configuration | Blocked by a Deny/Require rule in .htaccess → 403 |
Options ExecCGI is off / Invalid command | Unsupported directive in .htaccess → 500 |
File does not exist | Missing file → 404 |
ModSecurity: Access denied | Firewall rule blocked the request; note the rule ID for support |
Premature end of script headers, End of script output before headers | The PHP or CGI process crashed or ran out of memory |
PHP error_log files
PHP writes errors to a file called error_log in the folder of the script that failed (for example public_html/error_log or public_html/wp-admin/error_log).
- Open File Manager, go to the site folder and open
error_logwith View or Edit. The latest lines are at the bottom. - Look for
PHP Fatal error. It names the file and line, for example a plugin folder, which tells you what to disable.
Examples: Allowed memory size of 134217728 bytes exhausted → raise memory_limit (see PHP options); Call to undefined function → missing extension or incompatible PHP version.
Tip: In WordPress you can also set define('WP_DEBUG', true); define('WP_DEBUG_LOG', true); define('WP_DEBUG_DISPLAY', false); in wp-config.php to log to wp-content/debug.log. Turn it off when finished.
Raw Access logs
- Open cPanel → Metrics → Raw Access.
- Under Configure Logs, tick Archive log files to your home directory so monthly logs are kept in
~/logs, and optionally remove the previous month's archive. - In Download Current Raw Access Archives, click the domain to download a
.gzfile. Open it with 7-Zip orzcat.
Each line looks like:
198.51.100.7 - - [13/Nov/2026:10:12:01 +0000] "GET /wp-login.php HTTP/1.1" 200 4520 "-" "Mozilla/5.0 ..."That is the IP, time, request, status code, size, referrer and user agent. Search for many POST /wp-login.php or xmlrpc.php lines from one IP to spot brute-force attempts, then block it in IP Blocker.
Quick log searches in Terminal
tail -n 50 ~/public_html/error_logzcat ~/logs/example.com-ssl_log-Nov-2026.gz | awk '{print $1}' | sort | uniq -c | sort -n | tailThe second command lists the IPs with the most requests this month. See cPanel Terminal.