DNS
Security
Email Deliverability
Systems
🔒 Security Checklist
File and Access Security
Set appropriate file permissions
Use 755 for directories and 644 for files. This allows the owner to read/write/execute, while others can only read/execute.
Check Robot.txt
Check robot.txt file for any exposed links to sensitive files or directories.
Ensure appropriate file ownership
Ensure that all files in CPanel accounts are owned by that cpanel user and never run composer as root when installing new dependencies.
Scan for malicious files and code
Use grep to search for suspicious code, eval statements, or unknown URLs. E.g., grep -r "eval(base64_decode" /path/to/webroot
Audit admin users in WHM and WordPress
Regularly review and remove any unused or unauthorized administrator accounts (for WordPress check directly in DB under users and usermeta tables).
Enable Two-Factor Authentication (2FA)
Enforce 2FA for all critical logins, including WordPress, cPanel, and WHM.
Use jail shells to restrict user access
Assign a jailed shell to cPanel users to prevent them from accessing other users' files or system-wide binaries.
Network and Server Security
Change default SSH port and restrict IP access
Move the SSH port from 22 to a non-standard port and use the firewall to allow only trusted IPs.
Block unsecure ports
Block ports 80, 110, and 143 but make sure that http is redirected to https via CloudFlare.
Use Real Cron Jobs
Disable pseudo-cron jobs in wp-config (DISABLE_WP_CRON, true), block external access to wp-cron, and setup a real internal cron job in its place.
Add a secondary SSH admin user with strong credentials
Create a non-root admin user with sudo privileges and disable direct root login.
Disable unused apps/plugins in WordPress and server
An unused component is an unnecessary attack vector. Deactivate and delete anything you don't need.
[NEW] Disable XML-RPC in WordPress
If not used for remote publishing, disable XML-RPC to prevent it from being a target for brute-force attacks. Add code via a plugin or theme.
Data Protection and Hardening
Set up redundant backups
Configure local backups and sync them to a secure cloud (e.g., AWS S3, Backblaze) and/or an offline location.
Implement CSRF tokens
Protect against Cross-Site Request Forgery (CSRF) by using nonces/tokens in forms and AJAX requests to validate user intent.
Enforce strong password policies
Use plugins or server policies to require complex passwords and periodic changes for all users.
Configure Cloudflare for DNS and security
Use Cloudflare's proxy (orange cloud) to enable its WAF, DDoS mitigation, and to hide your origin server's IP address.
Use WP Toolkit 'Secure' options in WHM
Apply multiple security fixes with one click, such as disabling file editing and blocking access to potentially sensitive files.
Enable SSL/TLS encryption
Use "Full (Strict)" mode in Cloudflare and ensure SSL is properly configured on the server to encrypt all traffic.
Protect sensitive files
Ensure files like wp-config.php and .env are not in a publicly accessible directory and have restrictive permissions (e.g., 400).
🗺️ DNS Checklist
Email Routing and SSL
Choose email hosting strategy
In cPanel's "Email Routing", select Remote for third-party services (Google/Microsoft), Local for this server, or Auto to decide based on MX records.
Verify MX records for mail routing
If remote, point MX records to your provider. If local, point the primary MX record to your server's hostname with priority 0.
Enable AutoSSL in WHM
Ensure AutoSSL (powered by cPanel or Let's Encrypt) is active to automatically issue and renew free SSL certificates for all domains.
Cloudflare DNS Management
Set domain nameservers to Cloudflare’s
Point your domain's nameservers at your registrar to those provided by Cloudflare to activate its services.
Configure core DNS records in Cloudflare
Ensure A (main site), CNAME (www), MX (mail), and other necessary records are correctly pointing to their respective server IPs or hostnames.
Email Authentication and Other Records
Generate and add DKIM record
In cPanel's "Email Deliverability", generate a DKIM key. Add the provided name and value as a TXT record in Cloudflare to sign outgoing mail.
Add AAAA record if server supports IPv6
If your server has an IPv6 address, create an AAAA record pointing to it for clients that use the newer protocol.
Cloudflare Configuration
Proxy web traffic through Cloudflare
Enable the proxy (orange cloud) for A, AAAA, and CNAME records pointing to your website to benefit from CDN, WAF, and IP masking.
Do not proxy mail-related records
Ensure the proxy is disabled (grey cloud / DNS Only) for MX records and any subdomains used for mail services (e.g., mail, smtp, imap).
Enable "Always Use HTTPS"
In Cloudflare's SSL/TLS settings, enable this feature to automatically redirect all http requests to https.
Add firewall rules to block/challenge traffic
In Cloudflare, block known malicious user agents, challenge traffic from certain countries, or protect your login pages from brute-force attacks.
⚙️ Systems Checklist
Automated Backups and Recovery
Schedule daily backups in WHM
Configure WHM's Backup Configuration to run daily, retaining a reasonable number of copies (e.g., 7-14 days).
Test backup restoration regularly
Periodically restore a backup to a staging environment to ensure data integrity and that the restoration process works as expected.
[NEW] Establish a Disaster Recovery Plan (DRP)
Go beyond backups. Document the full process for rebuilding your server and restoring services in a worst-case scenario.
Performance and Uptime Monitoring
Set alerts for resource thresholds
Configure your monitoring tools to send alerts (email, Slack) when resources exceed critical levels (e.g., CPU > 90% for 5 minutes).
Automated Updates and Maintenance
Enable automatic OS package updates
Configure unattended-upgrades (for Debian/Ubuntu) or dnf-automatic (for AlmaLinux/Rocky) to apply security patches automatically.
Use EasyApache for Apache/PHP updates
Run EasyApache 4 regularly in WHM to update your web server, PHP versions, and related modules.
Configure automatic log rotation
Ensure logrotate is properly configured to rotate, compress, and delete old log files to prevent disk space issues.
Automation and Integrations
Automate WordPress management with WP Toolkit
Use WP Toolkit in cPanel/WHM to configure automatic updates for WordPress core, plugins, and themes, as well as scheduled security checks.
Integrate alerts with Slack/Discord
Configure webhooks to send real-time notifications for monitoring alerts, security events, or successful backups to your team's chat platform.