Articles
How do I block an IP address or country?
To block specific visitors, log in to cPanel and open IP Blocker. Enter a single IP, a range, or...
How do I enable HSTS?
HSTS (HTTP Strict Transport Security) tells browsers to always use HTTPS for your site,...
How do I enable Leech Protection?
Leech Protection stops users from sharing a password to a protected area too widely. It watches a...
How do I enable SSL on a subdomain?
Subdomains get free SSL through AutoSSL just like main domains. First create the subdomain in...
How do I enable two-factor authentication for cPanel?
Two-factor authentication (2FA) adds a one-time code on top of your password, so a stolen...
How do I fix "mixed content" or "not secure" warnings?
A "mixed content" warning means your page loads over HTTPS but still pulls some files (images,...
How do I force my site to load over HTTPS?
After your SSL is active, redirect all traffic to HTTPS so visitors always use the secure...
How do I generate a CSR (Certificate Signing Request)?
A CSR is needed when ordering a paid SSL certificate. Generate it in cPanel under SSL/TLS, then...
How do I install a free SSL certificate (AutoSSL / Let's Encrypt)?
Free SSL is included on your hosting and is usually installed automatically. To check or trigger...
How do I install a paid / third-party SSL certificate?
If you bought an SSL certificate from another provider, you can install it yourself in cPanel....
How do I install a wildcard SSL certificate?
A wildcard certificate (issued for *.yourdomain.com) secures every subdomain at once. To install...
How do I keep my website and software up to date?
Outdated software is the top cause of hacks, so updates are your best defense. For most sites:Log...
How do I password-protect a directory?
You can lock a folder behind a login prompt using cPanel's built-in tool. Log in to cPanel and...
How do I prevent email spam and abuse from my account?
Keeping your account from sending spam protects your deliverability and keeps it from being...
How do I protect wp-admin or sensitive folders?
Adding an extra login in front of wp-admin stops most automated WordPress attacks. The cleanest...
How do I recover a suspended account after a security issue?
If your account was suspended after a hack, malware detection, or abuse complaint, recovery...
How do I renew my SSL certificate?
Free certificates issued by AutoSSL (Let's Encrypt / cPanel) renew automatically before they...
How do I report abuse or a security issue?
To report abuse, spam, phishing, or a security vulnerability involving a Toshost-hosted site or...
How do I scan my account for malware?
Your hosting includes Imunify360, which scans for malware right inside cPanel. Log in, find the...
How do I secure my cPanel account?
A few habits keep your account safe:Use a long, unique password for cPanel and change it if it's...
How do I set up SSH keys for secure access?
SSH keys let you log in securely without a password. If SSH is available on your plan, set them...
My site was hacked or has malware — what do I do?
Act quickly to limit damage. First, change every password: cPanel, FTP, email, database, and any...
What file permissions are most secure?
Use the least-permissive settings that still let your site work. Standard, secure values...
What is a ModSecurity 403/406 error and how do I fix it?
ModSecurity is a web application firewall that blocks suspicious requests. When it triggers, you...
What is cPHulk / brute force protection?
cPHulk is a server-side brute-force protection system in WHM that watches for repeated failed...
Why does my site say "not secure" even with SSL installed?
An installed SSL doesn't always mean the padlock shows. Common causes include:HTTPS isn't forced...
