How to Secure Your WordPress Site Using cPanel

Introduction

Security is one of the most critical aspects of managing a WordPress site. Since WordPress powers over 40% of all websites, it’s a popular target for hackers and malware. Fortunately, with cPanel, you have several built-in tools to help protect your WordPress installation — no advanced technical knowledge required.

This article will show you how to secure your WordPress website using cPanel features and best practices.

1. Install an SSL Certificate (HTTPS)

Using SSL ensures that data exchanged between your website and visitors is encrypted.

Steps:

1. Log into cPanel

2. Go to SSL/TLS or Let’s Encrypt SSL

3. Select your domain and click Install

4. Ensure your site URL starts with https://

Tip: After installation, update WordPress URLs via Settings > General in the WordPress dashboard.

2. Enable ModSecurity

ModSecurity is a firewall that protects your website from common attacks such as SQL injections and cross-site scripting.

Steps:

1. Go to ModSecurity in your cPanel

2. Toggle ON for your WordPress domain

3. Use Imunify360 for Malware Scanning

Imunify360 is a security tool available in many cPanel environments. It detects and removes malware from your files automatically.

Steps:

1. Open Imunify360 from cPanel (if available)

2. Run a malware scan

3. View and clean infected files with one click

4. Protect WordPress Files with File Manager

Make sure sensitive WordPress files are not writable or accessible to the public.

Actions:

• Use File Manager to check permissions:

  • wp-config.php should be 440 or 400

  • Disable directory browsing via .htaccess:

    apache

    CopyEdit

    Options -Indexes

5. Set Up Hotlink Protection

Hotlinking allows other websites to use your media (images, videos), consuming your bandwidth.

Steps:

1. Go to Hotlink Protection in cPanel

2. Enable it and add your domain to the allowed list

6. Use IP Blocker to Restrict Access

Block unwanted or suspicious IP addresses from accessing your website.

Steps:

1. In cPanel, go to IP Blocker

2. Enter the IP address or range to block

3. Save changes

7. Enable Two-Factor Authentication (2FA)

If your cPanel offers 2FA, you can add an extra layer of login protection.

Steps:

1. Go to Two-Factor Authentication

2. Scan the QR code with an authenticator app

3. Enter the code generated to verify

You can also install a 2FA plugin in WordPress for admin-level protection.

8. Keep WordPress, Themes, and Plugins Updated

Use WordPress Toolkit or the WP dashboard to keep your software up to date — outdated components are a top security risk.

9. Backup Regularly

Even with all protections, you should maintain backups.

Use cPanel’s Backup Wizard or tools like JetBackup to:

• Download full backups

• Restore your website if anything goes wrong

Bonus Tips

• Use strong, unique passwords for WordPress and cPanel

• Limit login attempts using security plugins

• Disable XML-RPC if not needed (can be a brute force entry point)

Conclusion

Securing your WordPress site using cPanel is both effective and manageable — even for beginners. By combining built-in cPanel features like SSL, ModSecurity, and Imunify360 with WordPress best practices, you can protect your website from most common threats.