Skip to main content

Managing cPHulk Brute Force Protection

cPHulk is the built-in security mechanism in cPanel/WHM that protects your server against brute-force attacks. It detects and blocks IP addresses that repeatedly fail login attempts.

We strongly recommend keeping cPHulk enabled on production servers.

1. Enabling cPHulk (via WHM)

To activate protection via the graphical interface:

  1. Log in to WHM using your root account.
  2. Navigate to Security Center > cPHulk Brute Force Protection.
  3. Click the toggle switch to On/Enabled.
  4. (Optional) Adjust the "Configuration Settings" tab to make the rules stricter or more lenient.
  5. Click Save.

2. Disabling cPHulk (Emergency / CLI)

If you are locked out of WHM or need to perform maintenance, you can disable cPHulk via the command line. This is useful if the web interface is unreachable.

  1. Connect via SSH or use the Video Display console.
  2. Run the following command to cleanly disable the service and its monitoring:
whmapi1 configureservice service=cphulkd enabled=0 monitored=0

To re-enable it later via command line:

whmapi1 configureservice service=cphulkd enabled=1 monitored=1

3. Whitelisting Trusted IPs

To prevent yourself (or your office) from ever being blocked, you should add your static IP to the whitelist.

  1. In WHM, go to cPHulk Brute Force Protection.
  2. Click on the tab Whitelist Management.
  3. Enter your IP address in the "New Whitelist Records" field.
  4. Click Add.
Tip:
Only whitelist static IP addresses (like your office VPN or server monitoring IPs). Whitelisting dynamic home connections can be a security risk if that IP is later assigned to an attacker.