1. cPanel & WHM Documentation
  2. cPanel Knowledge Base
  3. General Systems Administration
  4. How to Use Server Profiles
server whmadvanced

How to Use Server Profiles

Valid for versions 106 through the latest version

Version:

106

Last modified: March 26, 2024

Overview

Server profiles let you set up servers to perform specific tasks or functions. They also manage roles that enable or disable task-specific services. For example, the Mail server profile disables most non-mail services. This server hosts accounts that only need mail features and not other services.

  • You can configure your server’s profile with WHM’s Server Profile interface (WHM » Home » Server Configuration » Server Profile).
  • Server profiles hide some cPanel & WHM interfaces and block some associated API functions.
    • This feature doesn’t block you from manually installing software.
    • Attempts to customize this feature are not supported and can cause unwanted results.
Important:

The system uses the dynamicui.conf files’s roles and services values to display and hide features in the interface. Don’t modify this file or these values. We don’t support this behavior.

Server profiles and licenses

Your cPanel & WHM license may determine your server’s profile.

  • You can buy a cPanel Solo® License for a server that uses any profile, but that server’s cPanel & WHM access will only allow one user.
  • For more information, read the Profiles section below.

Roles

Important:
  • If a role disables a service, the system disables the role’s related modules and functions.
  • If a server profile enables a service, the system will also enable service monitoring. To disable this, use WHM’s Service Manager interface (WHM » Home » Service Configuration » Service Manager).

Roles are collections of one or more services. Profiles use roles to provide specific server functionality. A server profile may consist of one or more of the following roles:

Role Description Module name Services
Calendars and Contacts Allows users to access CalDAV and CardDAV services and features. CalendarContact cpdavd
DNS Allows users to create and edit Domain Name System (DNS) zone files.
Important:
  • This role doesn’t convert your server to a cPanel DNSOnly® server.
 DNS bind, named, pdns, powerdns
File Storage Allows users to access cPanel’s File Manager and Git™ Version Control features.
Note:
When a profile disables this role, you can’t enable the Shell Access setting when you create a new cPanel account.
FileStorage There are currently no services for this role.
FTP Allows users to manage their account’s files with an FTP client. FTP ftpd, pureftp, proftpd
Local Mail Allows the control of local mail delivery and related features. MailLocal exim, dovecot
MySQL Client This role checks whether the MySQL/MariaDB client access exists locally or remotely.
Note:
You cannot directly enable or disable this role. The system enables or disables this role depending on the MySQL configuration.
MySQLClient None.
MySQL/MariaDB Allows users to create and manage MySQL® or MariaDB databases. MySQL mysql
PostgreSQL Allows users to create and manage PostgreSQL databases if cPanel & WHM manages the server’s PostgreSQL.
Note:
You must install PostgreSQL to enable this optional role.
Postgres postgresql
Receive Mail Allows users to receive mail from external sources. MailReceive cpanel_dovecot_solr, cpdavd, cpgreylistd, dovecot, imap, mailman, pop
Relay Mail Allows the server’s Message Transfer Agent (MTA) to forward mail from one remote host to another. MailRelay exim, exim-altport
Send Mail Allows users to send mail and control the features necessary for sending mail. MailSend exim, exim-altport
Spam Filter Allows users to use Apache SpamAssassin™ to identify, sort, and delete unsolicited mail. SpamFilter spamd
Webmail Allows users to access webmail services and features. Webmail There are currently no services for this role.
Web Disk Allows users to manage their account’s files with a WebDAV client. WebDisk cpdavd
Web Server Allows users to create and manage websites for their domains.
Important:
When a profile disables this role, the system takes specific actions. For more information, read the Disabled Web Server role section below.
WebServer httpd

Disabled Web Server role

When a profile disables this role, the system applies two restrictions:

  • You can’t enable the CGI Access setting when you create a new cPanel account.

  • The cpsrvd daemon takes over service for the standard HTTP ports 80 and 443.

    • This ensures that cPanel & WHM features that depend on these ports continue to function. For example, the AutoSSL, Mailman, and BoxTrapper features depend on these ports.
    • To prevent the cpsrvd daemon from serving ports 80 and 443, enable the Prevent cpsrvd from serving standard HTTP ports setting in WHM’s Tweak Settings interface (WHM » Home » Server Configuration » Tweak Settings).

Profiles

Important:

Server profiles provide performance improvements, not necessarily additional security.

Distributed accounts have the same level of access on the child node as they do on the parent node. This access allows linked nodes to work smoothly with existing systems. We are researching methods to transition to a reduced access security model in a future version.

You can select from one of the following profiles:

Standard

This profile provides all services and has access to all cPanel interfaces. This is the default server profile for a full cPanel & WHM license.

Roles

This profile provides all services and has access to all cPanel interfaces.

Disabled services

This profile doesn’t disable any cPanel & WHM services.

Interfaces
  • This profile enables all WHM interfaces.
  • This profile allows cPanel users access to all cPanel interfaces.

DNS

This profile allows the system to serve Domain Name System (DNS) zones.

Important:
  • If you purchase a DNS license, the system defaults to this profile.
    • You can’t select a different profile.
    • You must upgrade to a full cPanel & WHM license to select a new profile.
    • Only cPanel partners can purchase DNS licenses.
  • Selecting this profile doesn’t convert your server to a cPanel DNSOnly server.
Roles

This profile has the following role configuration:

Role Enabled Disabled Optional
Calendars and Contacts Disabled
DNS Enabled
File Storage Disabled
FTP Disabled
Local Mail Enabled
MySQL/MariaDB Optional
PostgreSQL Disabled
Receive Mail Disabled
Relay Mail Optional
Send Mail Enabled
Spam Filter Disabled
Webmail Disabled
Web Disk Disabled
Web Server Disabled
Disabled services

This profile disables the following services:

  • cpanel_dovecot_solr
  • cpdavd
  • cpgreylistd
  • ftpd
  • httpd
  • imap
  • mailman
  • mysql
  • pop
  • postgresql
  • proftpd
  • pureftp
  • spamd

Interfaces

By default, this profile disables the following WHM interfaces:

WHM section Interfaces
Account Functions
  • Raw Apache Log Download
  • Raw FTP Log Download
  • Web Template Editor
Account Information
  • List Subdomains
cPanel
  • Install cPAddons Site Software
  • Manage cPAddons Site Software
  • Reset a Mailman Password
DNS Functions
  • Email Routing Configuration
Email
  • Greylisting
  • Mailbox Conversion
  • Repair Mailbox Permissions
  • Spamd Startup Configuration
Restart Services
  • FTP Server (ProFTPd/PureFTPd)
  • HTTP Server (Apache)
  • IMAP Server
  • Mailing List Manager (Mailman)
  • PHP-FPM service for Apache
  • SQL Server (MySQL) — This interface is unavailable if you disable the optional MySQL/MariaDB role.
Security Center
  • Apache mod_userdir Tweak
  • ModSecurity® Configuration
  • ModSecurity® Tools
  • ModSecurity® Vendors
Server Configuration
  • Statistics Software Configuration
Server Status
  • Apache Status
Service Configuration
  • Apache Configuration
  • cPanel Web Disk Configuration
  • Exim Configuration Manager
  • FTP Server Configuration
  • FTP Server Selection
  • Mailserver Configuration
Software
  • EasyApache4
  • MultiPHP INI Editor
  • MultiPHP Manager
SQL Services
  • Additional MySQL Access Hosts
  • Change MySQL User Password
  • Database Map Tool
  • Manage Database Users
  • Manage Databases
  • MySQL Root Password
  • MySQL/MariaDB Upgrade
  • phpMyAdmin
  • Repair a MySQL Database
  • Show MySQL Processes
Transfers
  • Convert Addon Domain to Account

By default, this profile and the optional MySQL/MariaDB role allow cPanel users access to the following interfaces:

cPanel section Interfaces
Advanced
  • Track DNS
Databases
  • phpMyAdmin
  • MySQL Databases
  • MySQL Database Wizard
  • Remote MySQL
Domains
  • Domains
  • Dynamic DNS
  • Zone Editor
Email
  • Email Routing
  • Email Deliverability
Files
  • Backup — This profile limits functionality in this interface.
  • Backup Wizard — This profile disables this interface if you don’t enable the optional MySQL/MariaDB role.
Metrics
  • This profile disables this section.
Preferences
  • Password & Security
  • Change Language
  • Contact Information
Security
  • SSH Access
  • Manage API Tokens

Mail

This profile allows the system to serve mail. Certain cPanel & WHM features, such as AutoSSL and GNU Mailman, require HTTP service. On a Mail server profile, the server disables the web server but enables the cpsrvd service to handle the TCP ports 80 and 443. This ensures that HTTP-dependent cPanel & WHM features continue to function.

Warnings
Warning:

You must comply with all of the instructions below.

The following instructions apply to synchronization for linked mail child nodes:

  • Do not make changes to userdata files on a child node directly. We do not offer support if you make these changes. This behavior could cause the nodes to become out of sync.
  • You must manually update system settings on a linked node (for example, server or Exim configuration settings).
  • System and user configurations do not propagate from the child to the parent node.

Warning:
Role restrictions may allow access to restricted features in some contexts. We intend to remove this functionality in a future version.
The following instructions apply to cPanel accounts for linked mail child nodes:
  • Do not update your node’s hostname after you link two nodes. This operation could corrupt the nodes’ ability to communicate.
  • You cannot enable IPv6 on a cPanel account if you want to distribute that account to a mail node.
  • If you manually edited your zone templates, you must update the mail CNAME record. For example, update: 
    mail IN CNAME %domain%
    to: 
    mail IN CNAME %maildomain%

The following instructions apply to cPanel account restoration for linked mail child nodes:

  • When you restore a cPanel account, the A records for service subdomains may be different than when you created the cPanel account. Compare the restored zone records to your current records to repair them manually.
  • You must perform backups for linked cPanel accounts on the controller node.
Important:
A server that uses the Mail server profile disables web hosting features.

Roles

This profile has the following role configuration:

Role Enabled Disabled Optional
Calendars and Contacts Enabled
DNS Optional
File Storage Disabled
FTP Disabled
Local Mail Enabled
MySQL/MariaDB Optional
PostgreSQL Optional
Receive Mail Enabled
Relay Mail Enabled
Send Mail Enabled
Spam Filter Optional
Webmail Enabled
Web Disk Disabled
Web Server Disabled
Disabled services

This profile disables the following services:

  • ftpd
  • httpd
  • mysql
  • postgresql
  • proftpd
  • pureftp

Interfaces

By default, this profile disables the following WHM interfaces:

WHM section Interfaces
Account Functions
  • Raw Apache Log Download
  • Raw FTP Log Download
  • Web Template Editor
Account Information
  • List Subdomains
Clusters
  • DNS Cluster — This interface is unavailable when you disable the optional DNS role.
cPanel
  • Install cPAddons Site Software
  • Manage cPAddons Site Software
DNS Functions
  • Email Routing Configuration
  • This section is unavailable when you disable the optional DNS role.
Email
  • Mailbox Conversion
Resellers
  • Change Ownership of an Account
  • Edit Reseller Nameservers and Privileges
  • Manage Reseller’s IP Delegation
  • Manage Reseller’s Shared IP
  • View Reseller Usage and Manage Account Status
  • Change Ownership of Multiple Accounts (redirects to modify account)
  • Email All Resellers
Restart Services
  • DNS Server — This interface is unavailable when you disable the optional DNS role.
  • FTP Server (ProFTPd/PureFTPd)
  • HTTP Server (Apache)
  • PHP-FPM service for Apache
  • SQL Server (MySQL)
  • SQL Server (PgSQL)
Security Center
  • Apache mod_userdir Tweak
  • Compiler Access
  • ModSecurity® Configuration
  • ModSecurity® Tools
  • ModSecurity® Vendors
  • Shell Fork Bomb Protection
  • Traceroute Enable/Disable
Server Configuration
  • Statistics Software Configuration
Server Status
  • Apache Status
Service Configuration
  • Apache Configuration
  • cPanel Web Disk Configuration
  • FTP Server Configuration
  • FTP Server Selection
  • Nameserver Selection — This interface is unavailable when you disable the optional DNS role.
  • Manage Service SSL Certificates
Software
  • EasyApache4
  • MultiPHP INI Editor
  • MultiPHP Manager
SQL Services
  • This section is unavailable.
SSL/TLS
  • Manage SSL Hosts
  • Purchase and Install an SSL Certificate

By default, this profile and its roles let cPanel users access the following interfaces:

cPanel section Interfaces
Advanced
  • Track DNS
Domains
  • Domains
  • Dynamic DNS — This profile disables this interface if you don’t enable the optional DNS role.
  • Zone Editor
Email
  • Email Accounts
  • Forwarders
  • Email Routing
  • Autoresponders
  • Default Address
  • Mailing Lists
  • Track Delivery
  • Global Email Filters
  • Email Filters
  • Email Deliverability
  • Address Importer
  • Spam Filters
  • Encryption
  • BoxTrapper
  • Configure Greylisting
  • Calendars & Contacts
  • Email Disk Usage
Files
  • Backup
  • Backup Wizard
Preferences
  • Password & Security
  • Change Language
  • Contact Information
Security
  • SSL/TLS
  • SSL/TLS Status

Database

By default, this profile allows the server to only serve databases.

Warning:

This profile is experimental, and we do not recommend it for production environments.

Roles

This profile has the following role configuration:

Role Enabled Disabled Optional
Calendars and Contacts Disabled
DNS Disabled
File Storage Disabled
FTP Disabled
Local Mail Enabled
MySQL/MariaDB Enabled
PostgreSQL Optional
Receive Mail Disabled
Relay Mail Disabled
Send Mail Enabled
Spam Filter Disabled
Webmail Disabled
Web Disk Disabled
Web Server Disabled
Disabled services

By default, this profile disables the following services:

  • bind
  • cpanel_dovecot_solr
  • cpdavd
  • cpgreylistd
  • ftpd
  • httpd
  • imap
  • mailman
  • named
  • nsd
  • pdns
  • pop
  • powerdns
  • proftpd
  • pureftp
  • spamd

Interfaces

By default, this profile disables the following WHM interfaces:

WHM section Interfaces
Account Functions
  • Raw Apache Log Download
  • Raw FTP Log Download
  • Web Template Editor
Account Information
  • List Subdomains
Clusters
  • DNS Cluster
cPanel
  • Install cPAddons Site Software
  • Manage cPAddons Site Software
  • Reset a Mailman Password
DNS Functions
  • This profile disables this section.
Email
  • Greylisting
  • Mailbox Conversion
  • Repair Mailbox Permissions
  • Spamd Startup Configuration
Restart Services
  • DNS Server
  • FTP Server (ProFTPd/PureFTPd)
  • HTTP Server (Apache)
  • IMAP Server
  • Mailing List Manager (Mailman)
  • PHP-FPM service for Apache
Security Center
  • Apache mod_userdir Tweak
  • ModSecurity® Configuration
  • ModSecurity® Tools
  • ModSecurity® Vendors
Server Configuration
  • Statistics Software Configuration
Server Status
  • Apache Status
Service Configuration
  • Apache Configuration
  • cPanel Web Disk Configuration
  • FTP Server Configuration
  • FTP Server Selection
  • Mailserver Configuration
  • Nameserver Selection
Software
  • EasyApache4
  • MultiPHP INI Editor
  • MultiPHP Manager

Note:
This list does not include the optional PostgreSQL role.

By default, this profile allows cPanel users access to the following interfaces:

cPanel section Interfaces
Advanced
  • Track DNS
Databases
  • phpMyAdmin
  • MySQL Databases
  • MySQL Database Wizard
  • Remote MySQL
Email
  • Email Routing
  • Email Deliverability
Files
  • Backup — This profile limits functionality in this interface.
  • Backup Wizard
Metrics
  • This profile disables this section.
Preferences
  • Password & Security
  • Change Language
  • Contact Information
Security
  • SSH Access
  • Manage API Tokens

The cphttpd service

The system uses the cphttpd service on DNSOnly, MailNode, and other non-web hosting server profiles as a method to provide hostname SSL certificates. This process listens and responds to requests on ports 80 and 443 so that the AutoSSL service can run for your hostname.

Additional Documentation