MdmHost secures the server with CloudLinux CageFS, Imunify360, a firewall and daily backups. As a reseller you control the layer above: your login, your packages and how you react when a customer site is compromised. These habits prevent most security problems and limit the damage of the rest.
Before you start
You need WHM access on your reseller plan. Each section links to a step-by-step guide.
Protect your own access
- Enable two-factor authentication (see 2FA for WHM and cPanel).
- Use a unique password stored in a password manager.
- Give billing systems and scripts API tokens with limited privileges (see API tokens).
- Protect your MdmHost dashboard login as carefully as WHM.
Set safe defaults in packages
- Leave out features customers do not need, such as shell access, in your feature lists (see Feature Manager).
- Set hourly email limits and a bounce threshold in every package (see email limits).
- Include Two-Factor Authentication, Imunify360 and JetBackup in every feature list.
Keep customer sites healthy
- Outdated WordPress plugins are the number one cause of hacks. Encourage auto-updates for minor releases (see WordPress auto-updates).
- Ask customers to remove unused plugins, themes and old test installs.
- Recommend current PHP versions (see changing PHP version).
- Never install nulled themes or plugins for customers.
Watch for warning signs
- Sudden bandwidth or CPU spikes in resource monitoring.
- Customers reporting email delays (hourly limit reached by a spam script).
- Imunify360 detections in a customer's cPanel.
- Google Search Console or browser warnings (see reputation management).
Respond to a hacked account
- Contain: lower email limits or suspend the account if it is sending spam or attacking others.
- Reset credentials: cPanel, FTP, email, database and CMS admin passwords (see password reset).
- Clean: scan and clean with Imunify360, or restore from a clean JetBackup point (see restoring backups).
- Fix the cause: update or remove the vulnerable software.
- Inform MdmHost through a ticket if the server IP may have been blacklisted.
Warning: Do not unsuspend a compromised account until the entry point is fixed. Reinfection within hours is common otherwise.
Write it down
Keep a short security policy for your customers: what you monitor, when you suspend, how they can request restores. It sets expectations and makes your response consistent.
Frequently asked questions
Can I give customers SSH access?
Only when they need it and you trust them. CageFS isolates accounts, but a compromised SSH login is still a powerful entry point.
Who handles server-level attacks?
MdmHost. Firewall, DDoS mitigation, server updates and IP reputation are managed for you 24/7.
Should every customer have a security plugin?
Server-side Imunify360 covers scanning. A light plugin for login protection and 2FA is a good addition for WordPress.
How do I tell customers about a security incident?
Explain briefly what happened, what you did and what they must do, such as changing passwords. Clear, prompt communication keeps trust even after a hack.
Is a strong password policy enforced on cPanel?
The server requires a minimum password strength. You can encourage stronger passwords and 2FA in your welcome email and help pages.