How to Secure Your Website with cPanel's Security Tools

Fast Hive protects the server with rate limiting and IP reputation filtering on cPanel, FTP and wp-login. Inside your account, cPanel gives you a further set of tools to protect your own site - and most of them take under a minute to configure. This guide covers IP Blocker, Hotlink Protection, Leech Protection, Directory Privacy, Virus Scanner and Manage API Tokens, and when each one is genuinely the right answer.

IP Blocker

Security → IP Blocker refuses connections from an address or range before your site ever runs.

1. Open Security → IP Blocker.
2. Enter a single address (203.0.113.45), a range, or CIDR notation (203.0.113.0/24).
3. Click Add. Blocks take effect immediately.

Use it for a specific abusive source you have identified in Metrics → Visitors or Raw Access logs - a scraper hammering your site, or repeated attacks from one address.

Hotlink Protection

Hotlinking is another site embedding your images directly, so your account pays the bandwidth and I/O for their pages.

1. Open Security → Hotlink Protection.
2. Check the URLs to allow access list. Your own domains should be there - add any variants you use, including the www and non-www forms.
3. List the extensions to protect, typically jpg,jpeg,gif,png,webp,bmp.
4. Optionally set a redirect URL to serve instead of the blocked file.
5. Click Enable.

Test afterwards. Overly strict hotlink protection breaks legitimate uses: images in emails, social media link previews, and search engine image results. If your images vanish from social previews after enabling it, that is why.

Leech Protection

Security → Leech Protection watches a password-protected directory and acts when one account logs in from an implausible number of places - the signature of a shared or sold password.

1. Open Security → Leech Protection and select the directory to protect.
2. Set the number of logins allowed within a two-hour window.
3. Optionally set a redirect URL and an alert email address.
4. Choose whether to disable the compromised account automatically.
5. Click Enable.

This only applies to directories protected by Directory Privacy. It does not protect your CMS login, which has its own user system.

Directory Privacy

Files → Directory Privacy puts an HTTP password prompt in front of a folder, before any of your application code runs.

1. Open Files → Directory Privacy and navigate to the folder.
2. Click Edit beside it.
3. Tick Password protect this directory and give it a display name.
4. Click Save, then create a user with a generated password.

This is the right tool for a staging site you do not want indexed, a client preview, or an internal file area. Because it sits in front of the application, it also blocks bots that would otherwise be brute-forcing a login page behind it.

Virus Scanner

Advanced → Virus Scanner scans your account for malware.

1. Open Advanced → Virus Scanner.
2. Choose what to scan - mail, home directory, public web space, or public FTP space.
3. Click Scan Now and wait. A full home directory scan on a large account takes a while and consumes I/O, so avoid running it at peak times.
4. Review anything reported before acting on it.

Manage API Tokens

Security → Manage API Tokens creates tokens that let external tools operate on your cPanel account without your password.

• Create a separate token per integration, named so you know what it is for.
• Set an expiry date rather than leaving tokens valid forever.
• The token is displayed once. Copy it immediately.
• Revoke tokens the moment an integration is retired.

If you do not use API integrations, there should be no tokens listed. An unexpected token is worth investigating.

A practical security routine

Signs your account may be compromised

• A sudden flood of bounce messages for mail you did not send.
• Files in public_html with recent modification dates you cannot account for.
• An administrator user in your CMS that you did not create.
• Resource usage spikes with no matching visitor traffic.
• Your site redirecting elsewhere for visitors arriving from search, but not when you type the address directly.
• A browser or search engine warning that the site is unsafe.

If you see these, do not simply delete files and move on. Open a ticket straight away - and change your cPanel, email, FTP and database passwords.

Troubleshooting

Frequently asked questions

Does Fast Hive protect my site from attacks?

We protect the platform - rate limiting and IP reputation filtering on cPanel, FTP and wp-login, plus layered network security. What runs inside your account is yours to keep updated. Both halves matter.

Do I need a security plugin as well?

A reputable one adds useful application-level protection such as login limiting and file integrity monitoring. Run one, not three - overlapping security plugins conflict and consume resources.

Should I block traffic from other countries?

Usually not. It blocks real customers, travellers and VPN users, and determined attackers simply use an address elsewhere. Block specific abusive addresses instead.

My site was hacked. Will restoring a backup fix it?

Restoring removes the damage but not the vulnerability, so it typically comes back. Restore to a point before the compromise, then immediately update everything and rotate all passwords.

Is Directory Privacy enough to secure a staging site?

For keeping it out of search results and away from casual visitors, yes. It is not a substitute for keeping the staging site's software updated - and remember that staging copies usually contain real customer data.

How do I know if someone has my cPanel password?

Check Last Login IP Address on the cPanel home screen. If it is not you, change your password immediately and open a ticket.