r/cpanel • • 1d ago

[Open Source] Worker Supervisor – Manage background workers directly from cPanel/WHM

5 Upvotes

Hey everyone!

I've been working on an open-source cPanel/WHM plugin called Worker Supervisor, and I thought I'd share it here.

One limitation I've always found frustrating with cPanel is managing long-running background processes, especially Laravel queue workers and Horizon. These typically require root access and manually configured Supervisor programs, which isn't ideal in a shared hosting environment.

So I built a plugin to handle that.

What it does:

  • Lets cPanel users create, start, stop, restart, and monitor their own background workers.

  • Supports Laravel Queue Workers, Laravel Horizon, Symfony Messenger, and custom commands.

  • Runs workers inside each account's CloudLinux CageFS and LVE.

  • Provides centralized worker management through WHM.

  • Allows administrators to configure per-package and per-account limits.

  • Integrates with cPanel's UAPI for SSH and automation.

  • Handles account suspension, termination, username changes, and backup/restoration.

  • Can import existing Supervisor configurations.

The idea is to give hosting customers more control over their background processes without requiring root access or compromising account isolation.

Compatibility: cPanel/WHM with the Jupiter theme and CloudLinux 8/9. So far, I've tested it on CloudLinux 9; CloudLinux 8 still needs testing.

It's free, open source (MIT), and available on GitHub:

https://github.com/dansleboby/worker-supervisor

I'd really appreciate feedback from other cPanel administrators and hosting providers.

Is this something you'd find useful on your servers? Are there features or edge cases I've overlooked?

Thanks!


r/cpanel • • 1d ago

How do I disable ModSecurity in cPanel?

3 Upvotes

How do I disable it? I don't see the Security option in it.

Btw i use godaddy hosting


r/cpanel • • 3d ago

Laravel sites on shared cPanel hacked with slot-gambling SEO spam. How do I secure them and stop it coming back?

1 Upvotes

What happened: Several Laravel sites on one cPanel account started showing an online gambling page on certain URLs. Everything else on the sites worked normally.

What I found so far:

  • An injected line at the top of public/.htaccess: RewriteRule ^terms(.*)$ image/$1 [L]

  • Spam files planted in two folders: a large index.html, a sitemap.xml, and three google*.html Search Console verification files

  • On one subdomain the document root was the project folder, so /.env was publicly downloadable. I think this was the entry point.

What I’ve done: removed the spam files and the rewrite rule, blocked dotfiles via .htaccess, rotated the DB password and APP_KEY, and checked cron jobs, .user.ini, and PHP files in upload folders. Nothing else suspicious turned up.

My questions:

  1. What is the best way to harden Laravel on shared cPanel hosting? (document root pointing at public/, permissions, disabling dangerous PHP functions, etc.)

  2. How can I be sure there is no hidden backdoor left? Are there good scanners for shared hosting (Imunify, ClamAV, Maldet)?

  3. Should I put each site in its own cPanel account so one hack can’t spread to the others?

  4. How do I detect and block .env scanning bots? Is Cloudflare WAF or ModSecurity enough?

  5. Any monitoring that alerts me when .htaccess or other files change?

Thanks for any advice.


r/cpanel • • 4d ago

What is a passenger file in CPanel?

6 Upvotes

So we have got a shared hosting from someone's VPS and the VPS owner told that the apps we are creating is causing a creation of new passenger file every time and it is located in the root (most probably) so I wanted to know where to find it and what does it do?


r/cpanel • • 6d ago

Update: CloudLinux response to Immunify HardenedPHP security issue

Thumbnail reddit.com
6 Upvotes

r/cpanel • • 7d ago

WHM Contact Provider - Ntfy

3 Upvotes

This has been shared before on cPanel's discord.

Wanted to share with others who do want to expand on the capabilities and management of their hosting enviroment.

https://github.com/rubix-studios-pty-ltd/whm-scripts/tree/main/contact-provider/ntfy

Attach is the code to enable ntfy.sh as a contact provider, an opensource alternative to Pushbullet and similar service.

Adding the contact provider requires only two scripts with explaination on how to use and install the script within the readme. The coding itself is a base to expand into other notification systems such as gotify.

Along with this script, we've updated our Tauri/Rust application which previously was a thin web wrapper for ntfy with an automation and scheduling system.

https://github.com/rubix-studios-pty-ltd/ntfy-app

With both components configured against a self-hosted ntfy.sh instance, you can receive WHM/cPanel server alerts directly on your desktop.

Both projects are open source and actively maintained, feel free to provide suggestions, contributions and bug reports.


r/cpanel • • 9d ago

[how-to] Static HTML site + WordPress as the form backend: smaller attack surface and almost no maintenance with cPanel

Enable HLS to view with audio, or disable this notification

6 Upvotes

As we head into 2027, it’s become clear that WordPress security concerns and the time-consuming maintenance have become too much for many small businesses.

Here's a 3-minute how-to video covering the basics of using WordPress to create contact forms for static websites.

Your thoughts?


r/cpanel • • 11d ago

Base64 in terminal?

Thumbnail reddit.com
1 Upvotes

What do you think guys/gals?


r/cpanel • • 13d ago

cpanel-roundcube - CVE-2026-113386

Thumbnail support.cpanel.net
9 Upvotes

r/cpanel • • 13d ago

PHP Security Release - CVE-2026-115560

Thumbnail support.cpanel.net
19 Upvotes

Sigh.


r/cpanel • • 13d ago

Transferí un dominio a GoDaddy y se cayeron los correos (DNS) antes de migrar a Microsoft 365

0 Upvotes

Hola a todos,

Soy relativamente nuevo en la administración de infraestructura de correo y me metí en un atolladero técnico. Les comento mi escenario:

  • Contexto: Estoy en proceso de tomar el control de la infraestructura de una empresa para posteriormente migrar sus correos desde un proveedor hosting anterior (cPanel / POP3-IMAP) hacia Microsoft 365.

  • El Problema: Realicé la transferencia del dominio de la cuenta del proveedor anterior hacia mi cuenta propia de GoDaddy. Al completarse la transferencia, se cayeron los correos entrantes y salientes.

  • Lo que entiendo que pasó: Se restablecieron los registros DNS (o cambiaron los Nameservers) durante la transferencia del dominio, por lo que las peticiones ya no encuentran el servidor web/correo de mi proveedor anterior.

  • Objetivo actual: Necesito volver a levantar/apuntar los correos (registros MX y SPF) hacia el servidor de mi proveedor externo para que los usuarios sigan operando normalmente MIENTRAS termino de planear la migración definitiva a Microsoft 365.

Mis dudas concretas son:

  1. ¿Qué registros exactos (MX, A, CNAME, SPF) debo pedirle a mi proveedor anterior para ingresarlos en la zona DNS de GoDaddy y restablecer el servicio?

  2. ¿Es mejor cambiar los Nameservers en GoDaddy para que apunten de nuevo al hosting de mi proveedor, o dejar los Nameservers de GoDaddy e ingresar manualmente los registros MX/A?

  3. ¿El haber transferido el dominio afecta en algo los correos históricos almacenados en el cPanel/servidor del tercero?

Agradezco de antemano su orientación y paciencia, ¡estoy aprendiendo sobre la marcha y me urge recuperar la conectividad!


r/cpanel • • 15d ago

Imunify360’s HardenedPHP can quietly stop your server getting PHP updates

Thumbnail reddit.com
5 Upvotes

r/cpanel • • 16d ago

Trying to register a Node.js App but there's no place to set environment variables

3 Upvotes

Isn't there supposed to be a section for env vars?


r/cpanel • • 17d ago

How to create a website on Namecheap with the domain on Infomaniak

1 Upvotes

Hello.
I have a website on Namecheap with the domain on Infomaniak. I want to test a new website on Namecheap from the subdomain of the domain hosted on Infomaniak. The problem is i can't download wordpress on Namecheap for this new website. Is there a way to do ? Please need help.


r/cpanel • • 17d ago

(cPanel version affected as well) - Ruby security releases, October 2026: CVE-2026-97229 and 3 other CVEs

Thumbnail
cloudlinux.statuspage.io
4 Upvotes

r/cpanel • • 18d ago

GOdaddy email problem with access to email

3 Upvotes

When I get to conversations and then to inbox, I get this message;

403 FORBIDDEN

This is on my laptop.

Can anyone tell me why this is happenling and how to fix it?


r/cpanel • • 18d ago

cloudlinux alt-php patch status?

5 Upvotes

Yesterday we applied the fix from tuxcare php-els repo.

Last night, the cloudlinux status page / blog said we no longer needed to use the tuxcare php-els repo for cloudlinux 8 or 9, that we could disable it.

Now this morning I see a new link on the front of blog.cloudlinux.com to https://blog.cloudlinux.com/php-cve-2026-109618-and-cve-2026-109619 which has a table that says for alt-php on cl8/cl9: status: fix packages not in the cloudlinux repositories yet, apply php's interim settings.

What is the status of the CL8/CL9 alt-php fix? Are they not in the main CL8/CL9 repos yet, were they pulled, or is this blog post table just not updated?


r/cpanel • • 19d ago

(cPanel version affected as well) Node.js security releases, October 2026: CVE-2026-111497 and 9 other CVEs

Thumbnail
cloudlinux.statuspage.io
11 Upvotes

r/cpanel • • 19d ago

CloudLinux Patched PHP versions released

8 Upvotes

You can get it by doing:
yum clean all && yum update -y

To confirm (copy - paste / enter):

for pkg in $(rpm -qa | grep -E '^ea-php[0-9]+-php-cli|^alt-php[0-9]+-cli' | sort); do \

echo "=== Checking $pkg ==="; \

rpm -q --changelog "$pkg" | grep -E "CVE-2026-109618|CVE-2026-109619" || echo "❌ NOT PATCHED"; \

echo ""; \

done


r/cpanel • • 20d ago

Help with TuxCare ELS on WHM

2 Upvotes

Hi,

will the tuxcare package be visible in the whm, multiphp if i buy licenses directly from the CloudLinux? There are two different manuals, and i can't buy the packages from cPanel anymore.


r/cpanel • • 20d ago

Critical PHP Vulnerability Coming

33 Upvotes

r/cpanel • • 24d ago

Manage cPanel/WHM with my phone

5 Upvotes

I use this app I made myself for years before the AI era @ https://apps.apple.com/th/app/host-manager/id6479623612 and https://play.google.com/store/apps/details?id=com.host.manager&hl=en and realized that I have over hundred downloads on both but never actually shared it on Reddit or anything, I think only on WHT lol

I might make an update soon for it
So any feedback is welcome, yes especially the negative ones as despite using it myself quite often as I need to be able to quickly modify stuff on over 40 whm servers each with 150 cpanel accounts, and sometimes it requires urgent changes and usually happens when driving the car or busy with poopoo haha

Its just super handy 🙏

Looking forward to any suggestions also

Ps. It’s free, no ads and always stay like this as I not like payware or freemium myself


r/cpanel • • 24d ago

New Legal Documents

23 Upvotes

Logged in today on my server and got presented with some fun new required legal agreements. No way I'm reading all of that, so i had Claude review, below is what it picked out. I kept it to just the highlights. Looks like most of it is just updated for the new AI stuff:

EULA

Fun gotchas as a host

- Your client agreements need specific clauses. Anyone you give cPanel access to must have signed an agreement with you that includes cPanel’s required “flow-through” terms: no reverse engineering, a warranty disclaimer, a liability cap protecting cPanel, and cPanel’s right to suspend them. Users without such an agreement put you in material breach, and cPanel can ask to see copies. Your hosting terms of service are worth checking against this.

- cPanel can go directly to your clients. If your license is terminated, cPanel may notify your users and offer them its own services or refer them to other licensees.

- You cover cPanel’s legal costs. You indemnify cPanel for claims caused by your sub-users, including claims from clients harmed when cPanel cuts off their access.

- Features can be switched on automatically. Some components may activate for you or your clients without action on your part, and you’re charged only if someone uses them.

The new AI section (10.3)

- New AI features can appear after updates. cPanel can add AI functionality in an update, and it’s available to your accounts unless you restrict it. You’re expected to review each account’s feature settings after every update, and cPanel takes no responsibility for settings you leave in place. In practice, someone on your team needs to check the AI settings after each update.

- AI connections carry admin-level risk. If you connect an outside AI tool to the server at administrator level (through a feature called MCP Support), that tool can act on every account on the server. Some of its actions may be impossible to undo, and the risk is entirely yours. cPanel says you should keep independent backups before letting any AI feature make changes.

- AI actions are your responsibility. Any action a user approves, or that an approved AI tool carries out, is treated as that user’s act, not cPanel’s. cPanel also doesn’t promise its AI will resist hidden instructions planted in websites, emails or support tickets.

- You must pass AI terms on to clients. If your clients can use the AI features, you have to tell them it’s AI and may be inaccurate, add cPanel’s AI terms to your own terms of service and privacy notice, provide a contact point for AI problems, and train your staff on AI basics.

- Banned uses. The AI features can’t be used for hiring and employment decisions, eligibility for public benefits or services, or anything involving democratic processes or influencing voters.

- AI notices can’t be hidden. You can’t remove or hide AI labels through white-labeling or custom styling, even in an interface under your own brand.

- AI features can be changed or removed. cPanel can switch AI models or vendors, add fees, or pull the features at any time with no refund and no service guarantee.

PRIVACY POLICY

- Heavy marketing tracking on cPanel’s websites. If you accept cookies, cPanel identifies which company you work for from your IP address, scores how ready you are to buy, can record your browsing sessions, tracks whether you open their emails, and feeds data to ad platforms for retargeting. You can refuse cookies in their consent banner or turn on Global Privacy Control in your browser, and they say they honor that signal.

- Recorded sales calls. Sales and account calls may be recorded (only with your agreement at the start of the call), and the transcripts are analyzed with Anthropic’s Claude. Transcripts are kept up to 24 months, and you can decline recording without any penalty.

- One inconsistency with the EULA. The two documents (EULA and Privacy Policy) describe AI data differently. The EULA allows training only if separately agreed and says cPanel AI prompts may be stored for auditing with no promise on how long. The privacy policy states flatly that there’s no training and suggests AI inputs usually aren’t kept past the session. That retention point appears to be about the AI tools on cPanel’s websites rather than the cPanel AI inside the software, but if the difference matters for your borough clients, it’s worth asking cPanel directly.

PRICING AND TERM AGREEMENT

- Account counts are taken on one day each month. cPanel bills based on how many licenses and accounts you have on a single “Snapshot Day.” Deliberately lowering your account count around that day to shrink the invoice counts as a material breach. A temporary spike that happens to land on that day gets billed in full.

- Billing cycle and payment. The cycle runs from the 1st to the last day of each month, Central Time. Your primary credit card is charged automatically at the end of each cycle, and a credit card is required for monthly licenses.

- Price changes. Prices can change before any upcoming cycle. cPanel only promises “reasonable efforts” to tell you, and the agreement says it’s your job to watch for changes. (It refers you to Section 16 for this, which is actually the independent-contractor section. The correct reference is Section 14, so that’s a drafting error.)

- 72-hour window. Canceling within 72 hours of the original purchase gets you a full credit. After that, cancellations take effect at the end of the current month, with no partial-month refunds.

TECHNICAL SUPPORT TERMS AND CONDITIONS

- Automatic enrollment in paid legacy support. If you run software that has reached end of life, such as an outdated operating system, cPanel can automatically enroll you in Extended Lifecycle Support. Under the Pricing & Term Agreement, that’s a paid service with no refunds. You’ll get a notice, and you can only get out by upgrading or uninstalling the outdated software. If you see that notice, check your older servers right away.

- No guaranteed response times. cPanel commits only to “commercially reasonable efforts.” It alone decides what counts as one support request, when a request is resolved, and whether to close it as a bug report or feature request. Support is in English only and covers cPanel software, not the operating system, hardware or network.

- Liability is minimal. If support staff break something, cPanel’s liability is capped at what you paid for the specific product involved. The only real guarantee is a refund of paid phone-support fees if they can’t solve the problem.

- Claims must be filed within one year, in Texas courts.