Limiting login attempts is a simple but effective way to stop brute-force attacks in their tracks. Here’s how to configure it across cPanel services.
The Logic Behind Attempt Limits
Automated attacks rely on trying many password combinations quickly. By capping the number of allowed login attempts before triggering a lockout or delay, you remove the attacker’s ability to brute-force a password within any practical timeframe.
Where to Apply Attempt Limits
Attempt limits should be configured across every authentication point: cPanel, WHM, email (via webmail or IMAP/SMTP clients), and FTP.
How to Configure Limits via cPHulk
- In WHM, go to Security Center > cPHulk Brute Force Protection.
- Set the “Maximum Failures” threshold — the number of failed logins allowed before an IP is temporarily blocked (commonly 3–5 attempts).
- Configure the “Brute Force Protection Period,” which determines how far back cPHulk looks when counting failures.
- Set an appropriate “IP Based Failure Block Time” to determine how long a triggering IP remains blocked.
- Save your settings and test with a deliberately incorrect login to confirm the lockout triggers as expected.
Balancing Security and Usability
- Avoid setting limits so strict that legitimate users get locked out from simple typos.
- Combine attempt limits with account notification emails so users know when their account has been locked and why.
- Provide a clear, secure process for legitimate users to request an unlock if needed.
Extending to Applications
If your websites run CMS platforms like WordPress, apply similar login attempt limits at the application level using security plugins, since WHM-level limits don’t protect CMS admin panels directly.
Setting login attempt limits is a low-effort, high-impact control that shuts down brute-force attacks before they can gain traction.