WHM Tweak Settings explained: the options worth changing

Tweak Settings is the largest settings page in WHM, with hundreds of options spread over many tabs. Most defaults are sensible, and changing things at random is a good way to break mail or logins. This guide picks out the settings that matter on a typical VPS, explains what they do and suggests when to change them.

Before you start

• Root access to WHM on a cPanel server running on a Linux VPS.
• A recent backup of the server configuration, or at least a copy of the settings file (shown below).
• A note of every change you make, so you can undo it.

Take a copy of the file that stores these settings before you start:

cp -a /var/cpanel/cpanel.config /root/cpanel.config.$(date +%F)

Find your way around

Go to Home » Server Configuration » Tweak Settings. The tabs include Compression, Display, Domains, Logging, Mail, Notifications, PHP, Redirection, Security, SQL, Stats and Logs, Status, Support and System, plus an All view.

Use the Find box at the top. Typing a word such as hourly or referrer filters the list across every tab. Each option shows its default next to it, and a Save button sits at the bottom of the page.

Domains tab

The defaults here protect users from each other. Leave these Off unless you have a very specific reason:

• Allow cPanel users to create subdomains across accounts
• Allow WHM users to create subdomains across accounts
• Allow Remote Domains

cPanel warns that enabling them can cause serious security problems, because one account could claim another's domain.

Keep these On:

• Prevent cPanel users from creating specific domains stops users adding well-known domains they do not own.
• Restrict document roots to public_html keeps every site inside the user's web folder.
• Thunderbird and Outlook autodiscover and autoconfig support makes mail app setup much easier for your users.

Mail tab

This is where most admins should make changes.

• Max hourly emails per domain: the default is unlimited. Setting a limit, such as a few hundred, stops one hacked site from sending thousands of spam messages and getting your IP blacklisted. Raise it for accounts that send legitimate newsletters.
• Maximum percentage of failed or deferred messages a domain may send per hour: works with the next setting to pause domains that mostly send to bad addresses, a strong sign of spam.
• Initial default/catch-all forwarder destination: decides what happens to mail for addresses that do not exist on new accounts. Fail bounces it and avoids filling a mailbox with spam. Avoid Blackhole, which discards mail silently.
• Track email origin via X-Source email headers: keep On. It helps you find which script sent a message.
• Enable Apache SpamAssassin spam filter and Enable Roundcube webmail: keep On if you host mail.

PHP tab

These settings control the PHP that runs cPanel and WHM themselves, not your customers' websites. For example, the cPanel PHP upload and POST limits affect uploads through File Manager and phpMyAdmin.

• Raise the cPanel upload and POST size if users need to import large database dumps through phpMyAdmin.
• Leave the execution time and loader settings at their defaults.

For website PHP settings, use MultiPHP Manager and MultiPHP INI Editor instead. See set PHP versions per domain with MultiPHP Manager.

Security tab

The defaults here are already secure. Settings worth knowing:

• Cookie IP validation: default strict. It ties a login session to the visitor's IP. Users on mobile networks whose IP changes may be logged out often. Only relax it if that becomes a real problem.
• Require SSL for cPanel Services: keep On. Logins should never travel unencrypted.
• Send passwords when creating a new account: keep Off, so passwords are not emailed in plain text.
• Generate core dumps: keep Off. Core dumps can contain passwords.
• Referrer safety check and Blank referrer safety check: both Off by default. Turning them on adds protection against cross-site request forgery but can break some bookmarks and API tools. Test first if you enable them.

Redirection tab

These options control how users reach cPanel, WHM and Webmail. The most useful is the setting that always redirects logins to the secure (SSL/TLS) port. Keep it on, so a user who types an http:// address lands on the encrypted login page. Once the hostname has a trusted certificate, you can also redirect to the hostname so users never see a certificate warning.

Check it works

1. Click Save and look for the success message at the top.
2. Search for each changed option and confirm its new value.
3. Compare with your backup copy to see exactly what changed:

diff /root/cpanel.config.$(date +%F) /var/cpanel/cpanel.config

Troubleshooting

• Users keep getting logged out of cPanel: cookie IP validation is strict and their IP changes. Switch it to loose for a while and see if it helps.
• Legitimate newsletters blocked: the hourly email limit is too low. Raise it, or set a higher limit on that package or domain.
• phpMyAdmin import fails on large files: the cPanel PHP upload or POST limit is too small. Raise both on the PHP tab.
• Something broke after many changes: restore the copied cpanel.config values one at a time in WHM, starting with the most recent change.

Next steps

• Set the core defaults first: Configure Basic WebHost Manager Setup.
• Review security warnings: use cPanel Security Advisor.
• Watch for abuse: investigate outgoing spam on cPanel.