cPHulk is cPanel's built-in protection against password guessing. It counts failed logins to cPanel, WHM, Webmail, email (IMAP/POP/SMTP), FTP and SSH, and blocks the offending IP or username for a while. It works alongside Imunify360, which also integrates with it.
MdmHost manages these server settings on shared, reseller and master reseller plans. This guide is for administrators of their own cPanel VPS or dedicated server with root access.
Before you start
- Root access to WHM and SSH.
- Your own static IP addresses, so you can whitelist them first.
Enable cPHulk
- Go to WHM → Security Center → cPHulk Brute Force Protection.
- Set the switch to On.
Whitelist your IPs first
- Open the Whitelist tab.
- Add your office and admin IPs, with a comment.
Warning: Whitelisted IPs skip all cPHulk checks. Only add fixed IPs you control, never dynamic or VPN ranges.
Configuration settings
On the Configuration Settings tab, the main values are:
| Setting | Suggested |
|---|---|
| Username-based protection: brute force protection period | 5 minutes |
| Maximum failures by account | 15 |
| IP-based protection: IP address-based brute force protection period | 15 minutes |
| Maximum failures per IP address | 5–10 |
| Block IP addresses at the firewall level if their login attempts are blocked | On (with care if Imunify360 manages the firewall) |
| One-day block after repeated blocks | On |
| Send notification on brute-force / root login | On |
Username protection blocks attempts on one account from many IPs; IP protection blocks one IP trying many accounts.
Country management
The Countries Management tab lets you whitelist or blacklist whole countries. Blacklisting countries you never do business with reduces noise, but can lock out travelling customers.
Review history
The History Reports tab shows failed logins, blocked users and IPs. Repeated failures from one customer IP usually mean an email client with an old password (see blocked IP help for users).
Unblock an IP
- In WHM: History Reports → find the IP → Unblock, or Flush DB to clear all blocks.
- From SSH, if you locked yourself out:
/usr/local/cpanel/scripts/cphulkdwhitelist 203.0.113.10If Imunify360 also blocked the IP, remove it there as well (see Imunify360 root setup).
Troubleshooting
Customers are blocked constantly
Thresholds are too low, or a shared office IP has one misconfigured device. Raise the per-IP threshold slightly and find the device.
You cannot reach WHM at all
Use your provider's console or another IP to SSH in and run the whitelist script above.
Frequently asked questions
Does cPHulk protect WordPress logins?
No. It protects cPanel services. Protect wp-login.php with Imunify360, LiteSpeed reCAPTCHA or a login-limit plugin.
Should I use cPHulk with Imunify360?
Yes. Imunify360 integrates with cPHulk; keep both enabled with the default integration.
Does it protect SSH?
Yes, password-based SSH logins are counted. Key-based SSH logins with passwords disabled are safer still.
Where does cPHulk store its data?
In its own database managed by the cphulkd service. Restart it with /usr/local/cpanel/scripts/restartsrv_cphulkd if WHM shows it as down.
Will legitimate users get an error message?
They see a normal login failure, even with the right password, while blocked. Explain this in your help pages so customers wait or contact support.