Neubox cPanel Security: Configuration and Errors to Avoid

Security in Neubox's cPanel doesn't come fully hardened out of the box: while the panel includes protection tools, the default configuration leaves several doors open that attackers routinely exploit. With a few targeted adjustments, you can close most of those gaps in under an hour.

Why Neubox cPanel's Default Configuration Isn't Enough

Neubox is one of Mexico's most popular hosting providers and uses cPanel as its administration interface, just like most of the market. The problem isn't exclusive to Neubox: cPanel on any shared host ships with settings optimized for compatibility, not security hardening.

The most commonly neglected areas are:

• Weak passwords on cPanel, FTP, and database accounts.
• Overly permissive file permissions (e.g., directories set to 777).
• Outdated PHP versions still active on the account.
• SSH access enabled without IP restrictions.
• Error logs exposed publicly.
• Outdated software (WordPress, plugins, themes).

Essential Security Configuration in Neubox cPanel

1. Strong Passwords and Two-Factor Authentication

The most common attack vector against cPanel is brute-force login attempts. Go to cPanel > Security > Two-Factor Authentication and enable 2FA using Google Authenticator or any TOTP app.

Also immediately change the password for:

• Your main cPanel account (at least 16 characters, randomly generated).
• Every active FTP/SFTP account.
• MySQL database users you no longer use — delete them entirely.

2. Fix File and Directory Permissions

The correct permissions for a typical web installation are:

You can review and fix permissions from cPanel > File Manager by selecting the public directory (public_html) and using the bulk permissions option.

3. Choose the Right PHP Version and Enable Security Options

Go to cPanel > MultiPHP Manager and make sure all your domains are running PHP 8.1 or higher (PHP 7.x reached end-of-life in 2022 and no longer receives security patches).

Then go to MultiPHP INI Editor and set these directives:

• expose_php = Off — prevents PHP version disclosure in HTTP headers.
• display_errors = Off — stops errors from being shown to site visitors.
• log_errors = On — saves errors to a private log instead of displaying them.
• allow_url_fopen = Off — blocks remote URL opening from PHP (a common RFI vector).
• session.cookie_httponly = On and session.cookie_secure = On — protects session cookies.

The Most Common Security Mistakes in Neubox cPanel

Mistake 1: Leaving Your WordPress Login Unprotected

If you use WordPress, the wp-login.php file is constantly hit by brute-force bots. Protect it with HTTP authentication from cPanel > Directory Privacy, or restrict access by IP by adding this to your .htaccess:

<Files wp-login.php>
  Order deny,allow
  Deny from all
  Allow from YOUR.IP.HERE
</Files>

Mistake 2: Not Reviewing Access Logs Regularly

cPanel includes raw Apache logs under Metrics > Raw Access. Reviewing them periodically (or setting up Webalizer / AWStats) reveals attack patterns, vulnerability scans, and unrecognized users accessing your panel.

Mistake 3: Ignoring the cPanel IP Blocker

The cPanel > Security > IP Blocker tool lets you deny access to your entire site from specific IP ranges. Use it to block known bot IP ranges and countries from which you receive no legitimate traffic.

Mistake 4: Leaving Orphaned Email and FTP Accounts Active

Former employee accounts or canceled project logins are silent entry points. Audit cPanel > FTP Accounts and cPanel > Email Accounts quarterly and remove everything you no longer use.

Built-In Neubox cPanel Security Tools You Should Enable

cPanel ships with several security tools that are often available but disabled or misconfigured:

• Leech Protect — detects and blocks users who share their credentials for password-protected areas. Useful for membership sites.
• Hotlink Protection — prevents other sites from embedding your images and consuming your bandwidth. Enable it from cPanel > Security > Hotlink Protection.
• SSL/TLS — Neubox includes free Let's Encrypt certificates. Verify that all your domains and subdomains have an active certificate, and that your .htaccess redirects HTTP to HTTPS with a 301 code.
• ModSecurity — server-level WAF. Neubox includes it in their plans; confirm it's active under cPanel > Security > ModSecurity. If a legitimate plugin triggers false positives, you can disable it per domain without affecting others.

If you've applied these steps and need a deeper audit of your hosting setup — or are considering migrating to a provider with stronger built-in security controls — the team at elenlace.com offers technical hosting reviews for businesses in Mexico.

You can also browse related provider comparisons in our hosting comparisons section to find options that come better configured out of the box.

Key Takeaways

• Neubox cPanel's default configuration prioritizes compatibility over security — applying the adjustments above closes most common attack vectors.
• Enable 2FA on cPanel immediately; it's the highest-impact measure for the least effort.
• Use PHP 8.1+ and disable display_errors, expose_php, and allow_url_fopen.
• Audit FTP, email, and database accounts at least quarterly and delete anything you no longer use.
• ModSecurity, Let's Encrypt, and Hotlink Protection are free and included — there's no excuse not to enable them.
• Review access logs regularly: they're your best early-warning system.

Want an expert to review your Neubox cPanel security configuration or evaluate whether another provider better fits your business? Reach out at elenlace.com for a no-obligation technical second opinion.

FAQ

Does Neubox include antivirus or malware scanning in cPanel?

Neubox shared hosting plans include Imunify360 or similar third-party solutions for server-level malware scanning. However, protection at your specific account level depends on maintaining correct file permissions and keeping software updated. Check under cPanel > Security to see which tools are active on your plan.

Is it safe to use FTP on Neubox?

Traditional FTP transmits credentials in plain text and should not be used. Neubox supports SFTP (SSH File Transfer Protocol) and FTPS (FTP over TLS), both of which are encrypted. Configure your client (FileZilla, Cyberduck) to connect only via SFTP on port 22, or via explicit FTPS on port 21 with TLS required.

How do I know if my Neubox site has been hacked?

The most common signs are: unexpected redirects to other sites, unknown files appearing in public_html, warning messages in Google Search Console, and Imunify360 alerts in cPanel. If you suspect a compromise, immediately change all passwords, review access logs, and contact Neubox support to run a server-level scan.

Do I need a dedicated hosting plan to have better security?

Not necessarily. A properly configured Neubox shared hosting plan is adequate for small and mid-size sites. The key difference with VPS or dedicated plans is isolation: on shared hosting, an attack against another client on the same server can affect performance, though it cannot directly access your files. If you handle sensitive customer data (payments, medical records) or high traffic, a VPS with CloudLinux isolation is the better choice.

Useful resources

Other providers and guides worth comparing:

• Hostinger
• HubSpot
• IONOS