Fresh cPanel/WHM installs ship with defaults that prioritise compatibility over security, deliverability, and sane resource limits. Most of them live behind WHM → Server Configuration → Tweak Settings, a 400-row screen that is intimidating to skim but pays back ten minutes of attention.
This article covers the 18 toggles that matter on a new server. Apply them once on initial provision, version the result with your configuration management, and move on.
How to find a setting fast
Tweak Settings has a search box at the top — use it. The headings below match the Setting name as it appears in the WHM UI, not the underlying cpanel.config key. Every change writes to /var/cpanel/cpanel.config and triggers the relevant service reload on save.
If you're scripting, edit the file directly and reload cpsrvd:
/usr/local/cpanel/scripts/restartsrv_cpsrvd
Settings applied via the UI take effect immediately.
Mail — outbound abuse defaults
cPanel's default mail policy assumes you trust every account. On a shared host, you do not.
Max hourly emails per domain
Default: 0 (unlimited). Set to 200-500 for shared hosting, higher for transactional senders. This is the single biggest day-one win against compromised account spam runs. Pair it with outbound throttling at the Exim layer for a hard ceiling that survives panel changes.
Prevent "nobody" from sending mail
Default: Off. Turn on. Legitimate mail goes through authenticated users; mail from nobody is almost always a PHP script that should be using a configured mailer or SMTP auth.
SMTP Restrictions
Default: Off. Turn on. Blocks direct outbound port 25 connections from anything except root, Exim, and the mailman user — stops malware from connecting to remote SMTP servers and bypassing your queue, headers, and rate limits.
Trust X-PHP-Originating-Script in email headers
Default: Off. Turn on. With this on, abuse reports actually tell you which PHP script sent the spam. Without it, you're grep-ing Exim logs by hand correlating timestamps.
Track email origin via X-Source headers
Default: On in current builds — verify. Adds X-Source, X-Source-Args, and X-Source-Dir headers naming the script and working directory of every outbound message.
For the full deliverability story — SPF, DKIM, DMARC, reverse DNS — see the email deliverability guide.
Security — login and session hardening
Cookie IP validation
Default: Loose. Set to Strict unless your users frequently hit cPanel from rotating mobile IPs. Strict mode invalidates a session cookie the moment the source IP changes — a stolen cookie replayed from a different network is useless.
Hide login banner version information
Default: Off. Turn on. Hides the cPanel/WHM version from the public login page so vulnerability scanners can't fingerprint your patch level without authenticating first.
Require two-factor authentication for cPanel access
Default: Off. Turn on for WHM and reseller access at minimum. Full end-user enforcement creates support load — make it opt-in for cPanel users and mandatory for staff and resellers.
Initial default/catch-all forwarder destination
Default: fail. Keep on fail. The old default was :blackhole:, which silently dropped mail to non-existent addresses and broke bounce processing for legitimate senders. If you're upgrading an old install, verify this one explicitly — it doesn't migrate automatically.
cPHulk Brute Force Protection has its own UI rather than living in Tweak Settings — see the cPHulk tuning guide for the values worth changing there.
System — accounting, shells, and noise
Use jailshell by default for new accounts
Default: On. Verify, and never change. Normal shell on a shared host is a path to whole-system enumeration.
Display Server Status
Default: On. Turn off. Exposes Apache mod_status data on the public WHM port — uptime, request rates, vhost names. Useful internally, leaks topology externally.
Enable cgroup memory and CPU accounting
Default: Off without CloudLinux. If you have CloudLinux installed, LVE handles per-user accounting and this setting is irrelevant. On stock AlmaLinux, turn it on so the WHM "Show Active Processes" view attributes resource use to the right account.
Disable Mailman
Default: Off (Mailman enabled). If you're not selling mailing lists — and most modern shared hosts aren't — turn this On. Removes the daily cron, the LMTP socket, and a chunk of attack surface.
Backups, stats, and bloat
Backup System
Default: Disabled in modern builds. Keep disabled — use JetBackup 5 instead of cPanel's built-in backups. The legacy backup system locks accounts during snapshot, doesn't handle incremental data, and has no usable retention model.
Statistics log retention (days)
Default: 0 (forever). Set to 30. Awstats and Webalizer history grows linearly and almost no end user looks past the last month.
Compress account archives in transfers
Default: On. For migrations between modern servers, set to Off — gzip on archive creation often becomes the bottleneck, and modern NVMe plus 10G networking move uncompressed pkgacct tarballs faster than the CPU can compress them.
Domains and account creation
Allow Remote Domains
Default: On. Turn off unless you specifically run a parking-page reseller business. With this on, any cPanel user can add a domain they don't own — the domain just won't resolve until DNS is pointed. Off prevents account creation from claiming a domain currently hosted elsewhere.
Strict domain name registration validation
Default: Off. Turn on. Rejects domains with invalid characters or TLDs that don't exist. Small thing, surprising amount of typo'd-domain garbage it filters at account creation.
Initial default web page
Default: cPanel-branded splash. Change to your own holding page so new accounts don't advertise the host's panel choice to anyone who hits the bare IP or an undelegated domain.
Verify, snapshot, and version
After applying changes, dump the running config and store it with your provisioning scripts:
/usr/local/cpanel/bin/cpconftool --backup
That writes a timestamped tarball under /var/cpanel/backups/ that can replay the entire Tweak Settings state onto another box with --restore. Treat it like infrastructure-as-code — commit the tarball, diff it on every change, and you'll never debug a phantom "why does this server behave differently" again.
If you're standing up a brand-new box, start from the cPanel VPS install guide and apply this list before opening the server to traffic.
FAQ
Where is the Tweak Settings file stored on disk?+
Will changing Tweak Settings affect existing accounts?+
What's the difference between Tweak Settings and Basic WebHost Manager Setup?+
Do Tweak Settings persist across cPanel upgrades?+
Can I apply the same Tweak Settings to multiple servers?+
Next steps
- Tune the brute-force layer in detail: WHM cPHulk tuning
- Lock down outbound mail completely: cPanel Exim outbound throttling
- Replace the built-in backup system: Disable cPanel backups with JetBackup
If you're provisioning a fresh server and need licensing in the same workflow, the cPanel license page lists tier options and same-day activation.