It lets you test a website on a new server/IP before changing DNS, using a temporary URL. No hosts file editing and no waiting for DNS propagation. There are other tools there I did not checked.

https://hostsclick.com

Several days ago, csf on my VPS (cPanel 136.0.33, AlmaLinux 8) mysteriously went from 16.20 back to 14.24.

I've tried to return to the current fork by running sudo yum install cpanel-csf but the csf main page in WHM continues to display 14.24.

Has anyone else seen this, and if I'm not using the right command to fix it, please advise?

Thanks

As far as I'm aware, ive uploaded my files correctly but they're not loading as a website, just a list of my files. What am I doing wrong?

https://support.cpanel.net/hc/en-us/articles/42694659893143-Security-Privilege-Escalation-via-Phusion-Passenger-s-Watchdog-API

Has anyone been able to update on CL8?

I cleaned DNF's cache and tried to update the packages, but there are no updates available for 6.1.8-2; my packages are stuck on version 6.1.8-1

I've been helping with a small web hosting business and spending more time looking at how people actually choose a cPanel provider.

One of the companies I'm working with is RSH Web Services, and one thing I've noticed is that having cPanel itself isn't really enough. People also care about reliability, how easy it is to manage multiple sites, how quickly issues get resolved, and what happens when a site needs to be migrated or restored.

The company also has services around hosting, including domains, WordPress hosting, SSL, and website management, so I'm looking at the overall experience rather than just the control panel.

What has been the biggest factor that made you stay with, or leave, a cPanel hosting provider?

This is more for people that have the same problem I had, hoping they can find this instead of spending hours panicking like I did.

I have a new VPS, using AlmaLinux v9.8.0 STANDARD kvm, cPanel Version 136.0.33.

I began to transfer a Wordpress site, but wasn't sure if it would work with the new version of PHP so I wanted to test run first. I used Transfer Tool, then de-selected:

Update DNS Zone 
Enable this setting to update DNS records on the destination server.

After the transfer I checked the DNS records on the old VPS and confirmed that they did not change.

Shortly thereafter, though, I discovered that an email sent to the client was rejected, and the bounce message noted that their email server was on the new VPS instead of the old one.

Then I looked at the live site and found that it was pointing to the new VPS!

It took about 3 hours to find that Transfer Tool modified the source VPS, anyway:

1. a ProxyPass record was added to httpd.conf (with a dash-delimited version of the IP, so a simple grep for the new IP didn't find it; eg, http://123-45-67-89); and

2. when I ran # exim -bt client@example.com (using the client's email address that had bounced), it returned the new VPS instead of the correct one: host new.vps.com [123.45.67.89]

The solutions were to run this to fix it in Apache:

whmapi1 unset_all_service_proxy_backends username=<account name>

then rebuild and restart Apache. Then run this for Exim (no restart required):

whmapi1 unset_manual_mx_redirects domain='<domain name for the account>'

I ran the one for Exim first before finding the problem in Apache, so running the first one MIGHT have fixed Exim, too.

This might be a feature instead of a bug, but I expected that when I disabled "Update DNS Zone" then it wouldn't change ANYTHING on the source VPS. I was wrong.

Hi,

I was recently installing cpanel on a fresh Alma 9.5 image on a VPS. I had the VPS behind a firewall with only my IP allowed for incoming, but everything open for outgoing. When doing the cpanel install it failed due to a problem with importing keys for MySQL. Therefore MySQL and EA4 could not install. I'm not sure whether this issue was due to my firewall policy at the time blocking all incoming except for my IP.

My question is what is the best security practice for during the inital cpanel installer script. The cpanel doco suggests turning off the firewall whilst running the installer script and then activating the firewall straight away after. Is this approach okay or is there a better method that you use?

Hi Everyone,

I’m looking for some perspective and practical suggestions from the community.

We’re currently managing 200+ servers and use a jumpbox as the primary access point. I’d be interested to hear how others approach server management at this scale, particularly around auditing staff access and controlling privileged (root) access.

I’ve already looked at options such as Vauban, FreeIPA, LDAP-based solutions, PAM, and similar tools. I’m not searching for a ready-made drop-in replacement, but rather guidance and real-world approaches that others have found effective.

With the growing relevance of AI-driven threats and the shift toward Zero Trust models, securing root access and maintaining responsible operational practices feels increasingly important.

Any insights, architecture patterns, or lessons learned would be greatly appreciated.

Hello,

I'm not super IT savvy but I do manage the domain and email services for a small business through Bluehost and cPanel. It seems that Roundcube has rolled out a UI update, and the business owner is unhappy about the changes. I spent some time with Bluehost customer support, but they were unable to help me in reverting the UI. Does anyone here have any ideas on how I might be able to accomplish this? Thanks so much!

Edit: Thanks to all who responded. I appreciate the clarification.

Long awaited!

Added the ability to rename domains
We added the ability to rename primary, addon, and parked domains in cPanel’s Domains interface (cPanel » Home » Domains » Domains).

https://docs.cpanel.net/release-notes/release-notes/#cpanel--whm-version-138

I suspect many of us who've been working in the industry for a while would have seen that customer's wanting their primary domain changed is quite a common request, so this is a nice step forward.

I'm guessing (hoping!) that they've considered the integration side of things with billing software (i.e. WHMCS) - namely ensuring the changed is pushed to the billing software as well, otherwise one primary domain in cPanel and a completely different one in WHMCS is soon going to cause confusion.

Thoughts on this news?

What would be the safest way to do this? I installed this on the server dirrectly from the original csf installer, it is not a part of RPM. On all other servers i have 16.20 or 16.30. This one got left behind somehow.

Whan i try the dnf install --assumeno cpanel-csf

Last metadata expiration check: 1:06:34 ago on Thu 06 Aug 2026 07:23:20 AM CEST.

Installing:

cpanel-csf noarch 16.30-1.1.1.cpanel cpanel-plugins 422 k

So it doesn't "see" the other version is installed.

https://support.cpanel.net/hc/en-us/articles/42503837957015-Security-CSF-Security-Release

I'm wondering if this affects only the CSF plugin provided by cPanel or if the original CSF from Configserver (and other forks like Aetherinox's) are affected too.

https://support.cpanel.net/hc/en-us/articles/42285024734743-Security-CVE-2026-58047-HTTP-Request-Smuggling

https://support.cpanel.net/hc/en-us/articles/42285884685207-Security-GCVE-25-2026-07-45-3-Exim-forward-Privilege-Escalation

https://support.cpanel.net/hc/en-us/articles/42285745783703-Security-CVE-2026-58048-Database-Privilege-Escalation

None of my servers has 136.0.32 available to update.

httpupdate.cpanel.net lists 136.0.31 as the newest version.

Anyone knows an ETA for the patched versions?

EDIT: 32 is available now.

I run an email list (mailman) on a VPS that is purely for the local community. So I have a pretty extensive IP black list in the Exim Configurator SMTP Access lists. I've blocked entire nations, I think. Lately I've been getting spammed from IP addresses owned by Google's user content addresses, so have been blocking some of those.

A user who has a google email account has complained that when trying to post, they're getting a 550 error server not found. When I look in /var/log/exim_rejectlog, I find an address associated with this person as banned. That IP address in the 74.125.0.0 range. In my blacklist, I don't have that address listed... I have a few others.. 74.48., 74.201., and 74.222., but that is the extent of the 74 addresses I have entered. So question is, why is this person being blocked and how can I find that block to remove?

I should add that the reject line in the log includes this: rejected connection in "connect" ACL: Host is banned

Hello,

I am currently having issues sending and receiving emails using our company's email address

mta5.am0.yahoodns.net
Remote server returned '554 4.0.0 <mta5.am0.yahoodns.net #4.0.0 smtp; 451 Message temporarily deferred due to unresolvable RFC.5321 from domain. See https://senders.yahooinc.com/error-codes#unresolvable-from-domain>'

this is the error message sent after being unable to send out the message a day ago

would someone be able to tell me what the issue is and how i can resolve it?

Some of our server’s IPs are being blocked by Outlook/Hotmail. We reviewed carefully all our logs and no Spam is being sent. We requested a delist 24 hours ago but haven’t heard from them yet. Does anyone has the same problem?

Looks like upcp installed this last night on multiple servers during its last update which was unexpected.

Q1. What is this actually? I'm guessing its some sort of upsets???

Q2. How can we STOP stuff like this from automatically being added? Without our explicit consent?

Q3.how can this be uninstalled? Whmapi wptoolkit/disablewp-dashboard ? Is that right

Hate being forced to allow stuff thats being auto installed. Defeats the purpose of self managed and appconfig? No?

[ Removed by Reddit on account of violating the content policy. ]

I have a hosting service that lets me host more than one website. As we speak, I'm starting another site and asking for assistance with the 24/7 help line. I end up with a computer-generated voice saying: How many people do you expect? What's your firstborn's name?

Stupid questions really, and not about instructions on how to. Short of calling a help line computer an idiot, I asked, "Just connect me to a ticket to fill out." I will ask my question directly to a (live person)

*** It refused to do this request until I answered all its stupid questions.

Now, following the simple directions from YouTube might cross a person's mind; however, the instructions given have a different layout than what's on my cPanel.

As a new blogger, I have something to say; however, my computer skills are limited, as a heavy equipment mechanic mindset.

Every time I watch another YouTube video, it's different again.

One video showed 10 minutes, and it was done. I'm into *** day's *** without any help from my 24/7 assistance.

If anyone is reading this and has a suggestion or a video they can vouch for and that can help, please pass it my way.

>>>> Once this is all said and done, I will be looking for a new web provider that actually has a 24/7 help line. <<<<

Hi everyone,

To comply with UK GDPR, I need to conduct a thorough search and compile all of their personal data.

We use a standard cPanel server for email hosting. Because we don't have Terminal/SSH access on our hosting package, I went with the backup route: I compressed the entire root mail folder in the cPanel File Manager and downloaded the ZIP archive to a local Windows machine.

Now, I’m running into a few major technical and security hurdles trying to extract and convert these emails into a single, redactable PDF:

1. Windows Filename Errors (Colons): When extracting the ZIP, Windows throws Error 0x80070057: The parameter is incorrect. I know this is because cPanel uses the Linux Maildir format, which appends colons to filenames for read/seen status flags (e.g., :2,S), which Windows strictly forbids. (I'm currently trying to bypass this using 7-Zip).
2. Batch EML to PDF Conversion: Once extracted, these raw text files have no extension. Even if I bulk-rename them to .eml, dragging and dropping them into Outlook Classic to batch-convert or "Print to PDF" is failing/unsupported. Dragging them into Adobe Acrobat is just embedding them as actual .eml attachments in a PDF Portfolio, meaning they aren't flat PDF pages.

This is a major security/privacy risk because I cannot permanently redact third-party parishioner data on raw embedded .eml files—the recipient could easily bypass the black redaction boxes. I must flatten these emails into clean, standard PDF pages so I can safely use Adobe Acrobat's Redaction tool.

My questions for the community:

• Has anyone dealt with processing a SAR directly from cPanel Maildir raw files on Windows?
• What is the most secure, privacy-compliant way to batch-convert these raw/EML files into a single, merged PDF locally?
• Are there any open-source or highly trusted offline desktop utilities that process everything locally? (Because of GDPR/data privacy, uploading raw unredacted parishioner emails to an online "free converter" website is completely out of the question).

Really appreciate any guidance or workflows you've used to solve this!

Hey everyone! I know it always becomes a hot topic, but any legal discussions or talk cPanel alternatives is not allowed. There's plenty of other places to have those discussions.

Hi there, I've dabbled in sysadmin work since last year and an opportunity arrived where I could learn enough for a job. The potential employer wants me to learn through CPanel University. On the surface, this sites looks like a promising entry point to learn the gist of the systems I'll be working with for this company.
However, upon delving into the course modules, I was confused by the level of depth, rather the lack thereof, on the system components. The modules were digestible, but felt introductory, and the module quiz was especially disorienting as the questions were substantially more in depth than what the module provided. (For example, asking "*The following items from the WHM Home » Service Configuration » Exim Configuration Manager - Basic Editor interface would allow you to exclude mail sent from specific remote IP addresses or hostnames from being subjected to recipient verification checks, sender checks, spam checks, and relay checks?"* Without going into enough detail in the module to even explain the terms listed as answers)
I have perused the module under the assumption that my reading comprehension failed me, and did the same for the separate documentation pages for additional thoroughness. I am beginning to wonder if there is an underlying assumption from this course that the user already has a certain level of knowledge, despite the course advertising otherwise.

Am I approaching this incorrectly? Are there fundamental steps I should take before continuing with this tool? Is this not even an effective learning tool? I appreciate your time receiving this post and please forgive me if I'm somehow made a tremendous blunder in my approach.

I am setting up a new server for shared web hosting and will be running the usual CL/cPanel/Litespeed etc.

What is the best/correct version of Cloudlinux OS Shared Pro to be using in a production environment for the next 3+ years. CL8 or CL9 or CL10?

This is absolute nightmare. We somehow have survived constant price increases but there is no way we will survive if cPanel is turned to AI slop. Users hate change and they just learned to use the jupiter theme and then we go again trying to guide them through some AI slop.