cPanel WHM Installation Guide: AlmaLinux, Rocky, Ubuntu

To install cPanel & WHM, start with a fresh, supported OS (AlmaLinux, Rocky Linux, or Ubuntu LTS) and a fully qualified hostname that resolves in DNS. Then run cPanel's official installer script as root, log in to WHM on port 2087, and finish the setup wizard. The install itself is one command. Most failures come from skipped prerequisites, so this guide covers those first.

Before You Start: System Requirements

cPanel only installs on a clean system. If Apache, Nginx, Exim, Postfix, BIND, MySQL, or another control panel is already there, the installer will refuse to run or leave you with a broken setup. Reinstall the OS instead of cleaning it up by hand.

Supported OS versions change as distributions reach end of life. Check cPanel's current documentation before you pick an image. CentOS 7 and similar older releases are no longer a sensible choice for new builds.

A VDS with root access, a dedicated IPv4 address, and enough RAM is a good fit. On a Nixcon VDS (VMware vSphere based), pick the OS image first and do the steps below on the clean install.

Step 1: Update the OS and Check SELinux

On AlmaLinux or Rocky Linux:

dnf -y update
dnf -y install curl perl screen
sestatus

If SELinux is enabled, disable it and reboot:

sed -i 's/^SELINUX=.*/SELINUX=disabled/' /etc/selinux/config
reboot

On Ubuntu:

apt update && apt -y upgrade
apt -y install curl perl screen
reboot

Reboot after a kernel update so the installer runs on the kernel you will actually use.

Step 2: Set the Hostname and DNS

cPanel needs a fully qualified domain name (FQDN) as the server hostname, such as server1.example.com. Three rules prevent most problems:

1. Use a subdomain, not a bare domain you will host on the server.
2. Create an A record for the hostname pointing at the server's primary IP before you install.
3. Make sure the hostname is not an alias of another record (no CNAME).

Set it on the server:

hostnamectl set-hostname server1.example.com
hostname -f

Verify DNS from the outside:

dig +short A server1.example.com
# Expected: 192.0.2.10

Also check /etc/hosts. A line like this avoids local resolution delays:

192.0.2.10   server1.example.com   server1

Plan your nameservers now. You will enter ns1.example.com and ns2.example.com in the setup wizard. Create A records for both. If you want glue records at the registrar, set them up before you go live with customer domains.

Also confirm the server can resolve names. A broken /etc/resolv.conf causes slow or failed installs:

dig +short cpanel.net

Step 3: Open the Required Ports

If a network or host firewall sits in front of the server, allow the ports cPanel uses. Use one firewall tool on the host, not several at once.

If you run a DDoS-protected network, make sure the protection layer does not block the management ports from your admin IPs.

Step 4: Run the Official Installer

Always use cPanel's own installer. Run it inside screen so a dropped SSH session doesn't interrupt the install:

screen -S cpanel
cd /home
curl -o latest -L https://securedownloads.cpanel.net/latest
sh latest

The install typically takes 30 to 60 minutes or more, depending on CPU and network speed. Follow progress in a second session:

tail -f /var/log/cpanel-install.log

If the SSH session drops, reattach with screen -r cpanel. When the installer finishes, it prints a completion message. Reboot once if asked.

Check the installed version:

/usr/local/cpanel/cpanel -V

Step 5: Log In and Complete the WHM Wizard

Open https://192.0.2.10:2087 (or https://server1.example.com:2087) and log in as root. Your browser will warn about a self-signed certificate until AutoSSL or a hostname certificate is issued. That is expected on first login.

The setup wizard asks for:

• Contact email: use a mailbox that is not hosted on this server, so alerts still reach you if the server is down.
• Hostname: confirm it matches the FQDN you set.
• Resolvers: use reliable recursive resolvers, either your provider's or a public one.
• Nameservers: enter ns1 and ns2. Let WHM create the A records if you host the zone locally.
• Main IP and additional IPs: confirm the primary IP.

Keep the defaults for the DNS and FTP services unless you have a reason to change them.

Step 6: Licensing

cPanel licenses are tied to the server's primary IP address. Buy the license from cPanel or an authorized partner, and make sure it is issued for the exact IP you installed on. If the license isn't active, WHM shows a license error. To force a refresh after activation:

/usr/local/cpanel/cpkeyclt

Check the license status for your IP at cPanel's license verification page. If you change the primary IP later, the license must be moved to the new IP.

Step 7: First WHM Settings Worth Changing

Do these before you create customer accounts:

• Update Preferences: choose a stable release tier and enable automatic updates. Run /usr/local/cpanel/scripts/upcp --force once to update to the latest build.
• Tweak Settings: review the settings for cPanel and Webmail SSL, referrer checks, and password strength rules.
• Basic WebHost Manager Setup: set the server contact email and default nameservers.
• Packages: create hosting packages with disk, bandwidth, and mailbox limits. Never put customers on the default unlimited settings.
• AutoSSL: enable it so new domains get certificates automatically. Make sure each domain's DNS points at the server, or validation fails.
• Backup Configuration: enable backups and store them off the server, on a remote destination. A backup on the same disk is not a backup.
• Mail: for outbound mail, make sure the sending IP has a matching PTR record and that SPF and DKIM are enabled for each domain. cPanel sets up the latter two by default.

Step 8: Security Hardening

A new cPanel server is scanned within hours of coming online. Apply these basics right away:

1. Use SSH keys and disable root password login. Set PermitRootLogin prohibit-password in /etc/ssh/sshd_config. Better still, log in as a normal user and use sudo. Test a second session before you close the first.
2. Enable two-factor authentication for root and resellers in WHM.
3. Turn on cPHulk (Security Center) to block brute-force attacks on WHM, cPanel, SSH, and mail. Whitelist your own admin IPs first.
4. Restrict WHM access using Host Access Control or your network firewall so ports 2087 and 22 are reachable only from trusted IPs.
5. Install ModSecurity with a maintained rule set from the WHM ModSecurity Vendors page. Start in logging mode, then enforce once false positives are tuned.
6. Run the Security Advisor in WHM and fix everything marked as a high-priority warning.
7. Keep everything updated. Automatic cPanel updates cover the panel and its services. OS packages need dnf update or apt upgrade on a schedule.
8. Limit outbound spam. Set a hourly mail-per-domain limit in Tweak Settings so one compromised account can't get your IP blacklisted.

Volumetric attacks can't be fixed at the host level. If you host customer sites, DDoS protection and firewall filtering in front of the server keeps attack traffic off the VDS itself.

Common Mistakes and Fixes

• Installer says another service is installed: the image isn't clean. Reinstall a minimal OS.
• Hostname errors in WHM: the A record is missing, or the hostname is a CNAME. Fix DNS, then run hostname -f and dig again.
• Installer fails right away on EL: SELinux is still enabled, or the OS version isn't supported. Check sestatus and cPanel's supported OS list.
• License error after install: the license was issued for a different IP. Reissue it for the correct IP, then run /usr/local/cpanel/cpkeyclt.
• Can't reach port 2087: a firewall rule blocks it. Check the network firewall and the host firewall separately.
• AutoSSL fails: domain DNS doesn't point at this server, or port 80 is blocked.
• Install interrupted: don't resume partway. Start over on a clean OS unless cPanel support tells you otherwise.

Final Checklist

• Supported OS, fresh install, SELinux disabled on EL
• FQDN hostname with a matching A record
• Nameserver A records created
• Installer run inside screen
• License active for the primary IP
• Updates, backups, AutoSSL configured
• SSH keys, 2FA, cPHulk, ModSecurity enabled
• Management ports restricted to trusted IPs

Do this once and you have a stable base for hosting. Test with a dummy account, then migrate real sites.