cPHulk is cPanel’s built-in defense against brute-force login attempts. Here’s how it works and how to configure it effectively.
What cPHulk Does
cPHulk is a security feature built directly into WHM that monitors login attempts across cPanel, WHM, FTP, and email services. When it detects repeated failed login attempts from the same source, it temporarily or permanently blocks that source from trying again.
Why Brute-Force Protection Matters
Automated attack tools can attempt thousands of password combinations per minute. Without a mechanism to detect and block this behavior, even a moderately strong password can eventually be guessed through sheer volume. cPHulk interrupts this process early.
How to Enable and Configure cPHulk
- Log in to WHM and navigate to Security Center > cPHulk Brute Force Protection.
- Click Enable if it isn’t already active.
- Configure the failure threshold — the number of failed attempts before a temporary block is triggered (a common setting is 5 attempts).
- Set the brute-force protection period, determining how long an IP remains blocked after triggering the threshold.
- Add trusted IP addresses to the whitelist to avoid accidentally locking out your own team during legitimate login retries.
- Enable notifications so you’re alerted when cPHulk blocks a suspicious source.
Fine-Tuning for Your Environment
- Review the blocked IP list periodically to confirm legitimate users aren’t being caught unintentionally.
- Combine cPHulk with IP restriction and strong passwords for layered protection.
- Adjust thresholds based on your team’s typical login patterns to balance security and convenience.
cPHulk is one of the easiest, most effective built-in tools available on cPanel servers, and enabling it should be considered a baseline requirement rather than an optional extra.