Softaculous ships with 450+ scripts enabled, and most shared hosts need maybe 40 of them. Every extra app is one more thing a customer can install, abandon, and let rot until it becomes a malware foothold — or one more CMS your support team gets asked about and has never touched. Trimming the catalogue is one of the cheapest hardening steps on a cPanel box.
This guide covers the four levers Softaculous gives you: the global enable/disable list, the blacklist.ser file, the CLI (for fleets), and ACL plans that map scripts to cPanel packages and resellers. It assumes Softaculous is already installed and licensed on cPanel.
Pick the right lever
| Goal | Tool | Scope |
|---|---|---|
| Remove an app for everyone | Admin Panel → Software, or CLI | Whole server |
| Lock an app off so the GUI can't re-enable it by accident | blacklist.ser | Whole server |
| Drop abandoned apps in bulk | --disable_outdated_script | Whole server |
| Different catalogues per hosting plan | Admin Panel → Plans (ACL) | Per package, user, or reseller |
| Hide Softaculous entirely from some accounts | ACL plan with the disable option, or WHM Feature Manager | Per package or user |
Start global, then layer plans on top. A script that is disabled server-wide can't be granted back by a plan.
Disable scripts globally in the Admin Panel
In WHM, open Plugins → Softaculous – Instant Installs, then click Software in the Softaculous Admin Panel. You get every PHP and JavaScript app with a checkbox. Untick what you don't want and click Update Settings.
Good candidates to cut on a typical shared node:
- Apps whose upstream is dead or barely maintained
- Heavy apps that don't fit your plan limits (full ERP and e-commerce suites on a 1 GB plan invite 508 resource limit errors)
- Forums, wikis, and galleries nobody on your customer base uses
Toggle scripts from the CLI
For more than one server, click-ops doesn't scale. Softaculous 4.7.9 and later expose enable/disable through cli.php. On cPanel, run it with cPanel's bundled PHP:
/usr/local/cpanel/3rdparty/bin/php /usr/local/cpanel/whostmgr/docroot/cgi/softaculous/cli.php --disable_script --sid=26,67
--sid takes a comma-separated list of script IDs — 26 is WordPress and 67 is Magento. Look up IDs in the Softaculous script list; the ID appears in each script's URL.
Re-enable the same way, or reset to the full catalogue:
/usr/local/cpanel/3rdparty/bin/php /usr/local/cpanel/whostmgr/docroot/cgi/softaculous/cli.php --enable_script --sid=67
/usr/local/cpanel/3rdparty/bin/php /usr/local/cpanel/whostmgr/docroot/cgi/softaculous/cli.php --enable_script --all
Keep your list of disabled IDs in config management (Ansible, Salt, a plain shell loop over SSH) and apply it after every new node is provisioned. That gives every server in the fleet the same catalogue without anyone logging in to WHM.
Disable outdated scripts in one pass
Softaculous 5.0.9 added a flag that disables every script whose vendor hasn't shipped an update in two years:
/usr/local/cpanel/3rdparty/bin/php /usr/local/cpanel/whostmgr/docroot/cgi/softaculous/cli.php --disable_outdated_script
This is the highest-value single command in this article. Abandoned apps are exactly the ones that never get a security patch, so auto-upgrades can't save them — see Softaculous auto-upgrades and backups for how the upgrade side works. Run it on a monthly cron so newly abandoned apps drop out automatically.
Lock scripts with blacklist.ser
The Admin Panel list is easy for another admin to change back by accident. For apps you never want on the server, use the blacklist file. On cPanel it lives at:
/usr/local/cpanel/whostmgr/docroot/cgi/softaculous/conf/blacklist.ser
On Plesk, InterWorx, and other panels the path is /usr/local/softaculous/conf/blacklist.ser. Create the file if it doesn't exist. It holds a serialized PHP array of script IDs — this uses WordPress (26) and Magento (67) as the example; swap in your own IDs:
echo -n 'a:2:{i:0;i:26;i:1;i:67;}' > /usr/local/cpanel/whostmgr/docroot/cgi/softaculous/conf/blacklist.ser
The count after a: must match the number of entries, and indexes run from 0. A typo breaks the array, so for longer lists generate it with PHP instead of writing it by hand:
/usr/local/cpanel/3rdparty/bin/php -r 'echo serialize([26, 67]);' > /usr/local/cpanel/whostmgr/docroot/cgi/softaculous/conf/blacklist.ser
Build per-package ACL plans
Plans are where the catalogue becomes a product decision. A starter plan gets WordPress and a handful of basics; a developer plan gets everything; an email-only plan gets nothing.
Create a plan
- In the Softaculous Admin Panel, click Plans, then Add a Plan now.
- Enter a Plan Name.
- Under Control Panel Plans, select the cPanel packages this plan applies to. Any account on those packages inherits the plan — this is the part that scales, because new signups are covered automatically.
- Optionally select Resellers and individual Users to attach them directly.
- Tick the scripts to allow (Select All is there if you're building an "everything minus a few" plan).
- Click Save Plan.
Tie plans to packages rather than usernames wherever possible. Package names already drive your WHM packages and feature lists, so the Softaculous catalogue follows upgrades and downgrades with no extra work.
Set a default plan
Accounts that don't match any plan get the full global catalogue. To change that, create a plan named exactly softaculous_default. It applies to every user not covered by another plan, which makes it the right place for a conservative baseline. Softaculous requires at least one user on the plan to save it — assign an internal test account.
Hide Softaculous from some accounts
To remove Softaculous completely for a package (email-only or DNS-only plans), create a plan for that package, select no scripts, and tick the disable checkbox Softaculous offers when you try to save an empty plan. Those users no longer see the Softaculous interface.
You can also switch off the Softaculous entry in WHM → Packages → Feature Manager for the relevant feature list. Use one method, not both, so the next admin knows where to look.
Let resellers manage their own catalogue
Resellers get a Softaculous Reseller Panel with its own Plans page. There they can pick which apps their end users see — useful for agencies reselling to clients who should only ever run WordPress. Resellers can only choose from scripts you've left enabled, so your global list and blacklist remain the ceiling. If you run resellers, pair this with WHM reseller ACLs so their panel permissions and app catalogue line up.
Licensing notes
None of this changes what you pay. A Softaculous Premium license covers unlimited accounts and installs on the server — $1.50/month for VPS and $2.50/month for dedicated, as covered in Softaculous licenses explained. Disabling scripts doesn't reduce the price, and adding plans doesn't add cost. Activate a Softaculous license if you're building a new node, or contact us for volume pricing across a fleet.
Next steps
- Set up Softaculous WordPress staging for the plans that keep WordPress
- Import existing installations into Softaculous so hand-built sites are tracked too
- Imunify360 WAF for WordPress virtual patching to cover the apps you do allow