Get started with cPanel and WHM on your VPS

cPanel & WHM is a commercial control panel for hosting websites, email, DNS and databases on a Linux server. This guide is for people who run their own VPS or cloud server and want to set up cPanel on it, from the first sign-in to a working website with SSL, email and backups.

WHM and cPanel: two interfaces​

The product has two parts that work together:

• WHM (WebHost Manager) is the administrator side. You sign in as root, the server's all-powerful user, to manage server settings, updates, security and hosting accounts.
• cPanel is the interface for each hosting account. An account usually holds one main domain plus its files, databases and mailboxes. You can give each client or project its own account and login, without giving them access to the whole server.

Get cPanel onto the server​

There are two ways to start:

• A ready panel image. Some providers let you pick an image with cPanel already installed when you order the server. This is the quickest option.
• The official installer. Create the server with a supported operating system, take a snapshot, then follow the installation guide in the cPanel & WHM documentation. Installation can take a while, so let it finish without interrupting the SSH session.

Sign in for the first time​

WHM and cPanel each have their own HTTPS port:

The server's firewall, and any cloud firewall in front of it, must allow these ports. Until the server has a certificate from a trusted authority, your browser may warn that the certificate is self-signed (created by the server itself rather than a certificate authority). That is expected on a new server. Check that the address is your own server before you continue.

Complete the initial setup​

The first time you sign in to WHM, a setup process walks you through the basics. In general terms:

SSL certificates​

cPanel includes AutoSSL, which requests and renews free certificates for the domains on each account. It only succeeds once a domain's DNS points at the server, so if a certificate is missing, check the domain's A records first. See SSL certificates for how certificates work.

Email​

Each domain that sends email from the server needs DNS records: an MX record pointing at the server, plus SPF, DKIM and DMARC records that prove the mail is genuine. cPanel can show you the values it expects. See SPF, DKIM and DMARC.

Receiving providers also check reverse DNS, which maps the server's IP address back to a name. It should match the server's hostname. Reverse DNS is set by whoever controls the IP address, so ask your server provider how to set it.

Backups​

WHM can create scheduled backups of every account. Store copies off the server too, for example in remote storage, because a backup on the same disk is lost with the server. Server snapshots add another layer before risky changes. See Snapshots and server backups.

Updates and security​

• Keep cPanel and the operating system updated. WHM can install updates automatically.
• Use a strong, unique root password, and turn on two-factor authentication for WHM and cPanel logins.
• Open only the ports you need, and restrict SSH where you can.
• Give clients their own cPanel accounts instead of sharing the root login.

Secure a new Linux server covers the general approach.

Official documentation​

• cPanel & WHM documentation

Related guides​

• Choose a control panel for your VPS
• Secure a new Linux server
• Snapshots and server backups
• SPF, DKIM and DMARC