Security Advisor is a built-in WHM tool that checks your cPanel server against a list of known weaknesses and tells you how to fix each one. Running it after setup, and again after major changes, is the fastest way to catch obvious gaps.
MdmHost manages these server settings on its hosting plans. This guide is for administrators of their own cPanel VPS or dedicated server with root access.
Before you start
- Root access to WHM and SSH.
- Console access from your provider before changing SSH settings, in case you lock yourself out.
Run Security Advisor
- Go to WHM → Security Center → Security Advisor.
- The scan runs automatically and lists findings by severity.
| Colour | Meaning |
|---|---|
| Red | Critical: fix as soon as possible |
| Yellow | Recommended improvement |
| Blue | Information |
| Green | Check passed |
Common findings and fixes
SSH password authentication is enabled
Set up SSH keys first, then disable password logins in WHM → Security Center → SSH Password Authorization Tweak. Keep a key-based session open while testing (see setting up SSH keys).
Compilers are accessible to unprivileged users
Open WHM → Security Center → Compiler Access and disable compilers for users. Attackers use compilers to build exploits.
cPHulk is disabled
Enable it (see cPHulk configuration).
Outdated PHP versions in use
Move accounts to supported versions with MultiPHP Manager or the CloudLinux selector (see PHP Selector admin settings).
Kernel update requires reboot
Reboot in a maintenance window, or use a live patching service such as KernelCare.
Apache modules: mod_userdir, symlink protection
Disable mod_userdir URLs in WHM → Security Center → Apache mod_userdir Tweak, and enable symlink protection in EasyApache settings. On CloudLinux, CageFS provides additional isolation (see managing CageFS).
ModSecurity has no rules
Install a vendor or Imunify360's WAF (see ModSecurity vendors).
Warning: Do not disable SSH password authentication until you have confirmed that key-based login works for root from a second terminal.
Beyond Security Advisor
- Keep cPanel and the OS updated automatically (see Update Preferences).
- Install a malware scanner and firewall such as Imunify360 (see Imunify360 setup).
- Configure off-server backups (see backup configuration).
Troubleshooting
A finding returns after fixing
Some checks need a service restart or rerun. Click Scan Again; if it persists, check whether an update reverted the setting.
Frequently asked questions
How often should I run it?
After initial setup, after major updates and monthly as a routine check.
Does fixing everything make the server secure?
It closes common gaps. Security still depends on updates, strong passwords, backups and monitoring.
Can it break customer sites?
Some changes, such as disabling compilers or old PHP versions, can affect specific sites. Announce changes and test first.
Is Security Advisor available to resellers?
No. It checks server-wide settings and is root-only.
What about the hostname SSL warning?
Install a valid hostname certificate so WHM and mail services use a trusted certificate (see the hostname SSL guide in WHM).