50+ Useful Linux Commands for WHM/cPanel Server Management

Every cPanel server is a Linux server underneath. WHM's buttons handle maybe 80 percent of the daily work, but the moment something actually breaks — Apache stops answering, the mail queue fills up with spam, disk hits 100% at 3 AM — the fix happens over SSH. This is our working list of Linux commands for cPanel servers: the ones our own admins type week after week, collected in one place with a copy button on every single command.

The title says 50+. The final count came to 71, because once we started writing them down it felt wrong to stop. They're grouped by job — getting in, finding things, reading logs, checking resources, restarting services, cPanel's own scripts, mail, databases, security, disk, DNS and backups — so you can jump straight to whatever is on fire right now.

Who this is for: anyone with root SSH on a VPS or dedicated server running WHM/cPanel. On shared hosting you won't have root — some file and log commands still work inside your own account, but the server-level ones need root. If you run a hosting business on reseller hosting, your provider handles the root side; this list is still worth bookmarking for the day you move up to your own server.

What's in this guide

• Getting into your server over SSH (1–4)
• Basic Linux commands for cPanel servers (5–13)
• Reading files and watching logs (14–21)
• Important SSH commands for load, RAM and processes (22–29)
• Restarting services the cPanel way (30–35)
• cPanel SSH commands: the /scripts/ directory (36–46)
• Exim mail queue commands (47–50)
• MySQL and database commands (51–54)
• Security and firewall commands (55–59)
• Disk space and inode commands (60–63)
• Network and DNS checks (64–67)
• Backups, archives and moving files (68–71)
• Cheat sheet: the 15 commands we use most
• Safety rules before you run anything as root
• FAQ

Getting into your server over SSH

SSH (Secure Shell) is the encrypted terminal connection every Linux admin lives in. On Windows, use the built-in terminal or PuTTY; on Mac and Linux, the terminal app is ready to go.

1. Connect to the server. Replace the IP with yours. If your host moved SSH off port 22 (a good habit), add -p with the right port.

ssh root@203.0.113.10 -p 22

2. Connect with an SSH key. Keys beat passwords — no brute-forcing a 4096-bit key. Point -i at your private key file.

ssh -i ~/.ssh/id_rsa root@203.0.113.10

3. See who else is logged in. Before heavy maintenance, check you're alone. This shows every active session, where it came from and what it's running.

w

4. Leave cleanly. Closes your session. Ctrl+D does the same thing.

exit

Basic Linux commands for cPanel servers

The everyday movement commands. Boring, until you realise the person who types them without thinking fixes servers twice as fast as the person who doesn't.

5. Where am I? Prints your current folder. Sounds trivial until you're about to delete something.

pwd

6. List everything in a folder. The -lah flags give you a long list, hidden files (.htaccess lives here) and human-readable sizes.

ls -lah

7. Move into a folder. On cPanel servers, a user's website lives in /home/username/public_html.

cd /home/username/public_html

8. Copy a file or folder. The -a flag copies recursively and keeps ownership and permissions intact — that matters on cPanel, where wrong ownership breaks sites.

cp -a public_html public_html-backup

9. Move or rename. Same command for both jobs.

mv old-name.php new-name.php

10. Create a folder (with parents). The -p flag creates the whole path in one go and never complains if part of it exists.

mkdir -p /home/username/backups/2026

11. Delete a file — carefully. The -i flag asks before each deletion. There is no recycle bin on a Linux server; gone is gone.

rm -i unwanted-file.php

12. Find a file by name. Where is that wp-config.php? This searches all of /home for it.

find /home -name "wp-config.php"

13. Find files changed in the last 24 hours. Our favourite hack-investigation command. A site got defaced? This shows every file touched in the last day.

find /home/username/public_html -type f -mtime -1

Reading files and watching logs

Half of server troubleshooting is just reading the right log. cPanel servers keep Apache logs in /usr/local/apache/logs/, mail logs in /var/log/exim_mainlog and login history in /var/log/secure.

14. Which OS is this box running? cPanel runs on AlmaLinux, Rocky Linux, CloudLinux and (on newer versions) Ubuntu. Good to know before you install anything.

cat /etc/os-release

15. Read a big file page by page. Arrow keys to scroll, / to search, q to quit. Never open a 2 GB log in a text editor.

less /usr/local/apache/logs/error_log

16. Watch the Apache error log live. The single most useful debugging command on a cPanel server. Load the broken site in your browser and watch the error appear in real time. Ctrl+C stops it.

tail -f /usr/local/apache/logs/error_log

17. Read the last 200 mail log lines. Bounce complaints, delivery failures, spam — the answers are in exim_mainlog.

tail -n 200 /var/log/exim_mainlog

18. Search a log for errors. grep is the search tool you'll use more than any other. The -i makes it case-insensitive.

grep -i "error" /usr/local/apache/logs/error_log | tail -n 50

19. Hunt for malware patterns in PHP files. base64_decode in a theme file is a classic infection sign. This searches every PHP file in an account. (For automated cleanup, that's what Imunify360 is for.)

grep -r "base64_decode" /home/username/public_html --include="*.php" -l

20. Count lines in a file. Quick way to gauge how big a log or CSV really is.

wc -l /var/log/exim_mainlog

21. What did I (or the last admin) run? Shows recent shell commands. Useful after "someone changed something and now it's broken".

history | tail -n 30

Important SSH commands for load, RAM and processes

When a server feels slow, these important SSH commands tell you within a minute whether the problem is CPU, memory, a runaway process or something else. Run them in this order and you'll look like you've done this for years.

22. Load average at a glance. The three numbers are load over 1, 5 and 15 minutes. Compare against your core count — load 8 on an 8-core box is busy; on a 2-core box it's an emergency.

uptime

23. How many cores do I have? Context for the number above.

nproc

24. Live process view. CPU, memory, and the processes eating them, refreshed live. Press q to quit, P to sort by CPU, M to sort by memory.

top

25. Memory in megabytes. Look at the "available" column, not "free" — Linux uses spare RAM for cache and gives it back when needed.

free -m

26. Top 15 CPU-hungry processes. Faster than top when you just want the culprit's name and PID.

ps aux --sort=-%cpu | head -n 15

27. Top 15 memory-hungry processes. Same idea for RAM. On cPanel boxes the usual suspects are MySQL, clamd and PHP-FPM pools.

ps aux --sort=-%mem | head -n 15

28. What's listening on which port? Confirms Apache is on 80/443, MySQL on 3306, and exposes anything that shouldn't be listening at all.

ss -tulpn

29. Did the kernel kill something? When a process vanishes mysteriously, check for out-of-memory (OOM) kills in the kernel log.

dmesg | tail -n 30

One note if you host many users on one machine: per-account CPU and memory limits are exactly what CloudLinux was built for — one heavy WordPress site stops being able to slow down the other forty.

Restarting services the cPanel way

You can restart services with systemctl like on any Linux box, but cPanel ships restart wrappers in /scripts/ that also rebuild configs and log the restart properly. When both exist, we prefer the cPanel wrapper.

30. Check a service's status first. Before restarting anything, see what state it's in and read the last few log lines it printed.

systemctl status httpd

31. Restart the web server (generic way). Works for httpd, mysqld/mariadb, exim, named, dovecot and friends.

systemctl restart httpd

32. Restart the web server (cPanel way). Same job via cPanel's wrapper. If you run LiteSpeed instead of Apache, this handles it too — LiteSpeed replaces httpd transparently.

/scripts/restartsrv_httpd

33. Restart WHM/cPanel itself. When WHM won't load on port 2087 but the sites are fine, restart the cpsrvd daemon.

/scripts/restartsrv_cpsrvd

34. Restart MySQL/MariaDB. Databases hold live data — restart during low traffic when you can, and check the status output afterwards.

/scripts/restartsrv_mysql

35. List every failed service. One command shows everything systemd thinks is broken right now.

systemctl list-units --state=failed

cPanel SSH commands: the /scripts/ directory

These are the cPanel SSH commands that don't exist on a plain Linux server — scripts cPanel ships in /scripts/ (a symlink to /usr/local/cpanel/scripts/). They automate account management, repairs and updates. The full catalogue is in the official cPanel scripts documentation; these eleven are the ones we actually reach for.

36. Update cPanel/WHM. Pulls the latest cPanel release plus system updates. Run it in a screen session if your connection is shaky (see the safety section).

/scripts/upcp

37. Which cPanel version is installed?

/usr/local/cpanel/cpanel -V

38. Rebuild the Apache config. After manual vhost edits or when Apache refuses to start over a corrupt config, rebuild it from cPanel's own data and restart.

/scripts/rebuildhttpdconf

39. Back up one account to an archive. Creates the same cpmove tarball WHM's transfer tools use — databases, mail, files, settings, everything.

/scripts/pkgacct username

40. Restore an account from that archive. The other half of the pair. This is how accounts move between cPanel servers.

/scripts/restorepkg username

41. Suspend an account. Site and mail go offline, data stays. The reason text shows up in WHM.

/scripts/suspendacct username "unpaid invoice"

42. Unsuspend it.

/scripts/unsuspendacct username

43. Delete an account — permanently. ⚠️ This removes the account and all its data. Run pkgacct first, every single time. No exceptions.

/scripts/killacct username

44. Fix mail permission problems. When a mailbox stops receiving after a migration or a botched chown, this repairs mail ownership across the server.

/scripts/mailperm

45. Fix disk quotas. When WHM shows 0/unlimited for accounts that clearly have quotas, rebuild the quota database.

/scripts/fixquotas

46. Talk to WHM's API from the shell. whmapi1 exposes nearly everything WHM can do. This one lists every account with its domain, IP and plan — handy for scripting.

whmapi1 listaccts | head -n 40

Exim mail queue commands

cPanel uses Exim for mail. A queue that normally sits under 50 messages suddenly showing 20,000 means one thing: a compromised account or form is pumping out spam, and your server IP is about to land on blacklists.

47. How many messages are queued? Check this number first. Memorise your server's normal.

exim -bpc

48. Look at what's actually in the queue. Shows sender, recipient and message ID for queued mail. Spam floods are obvious at a glance.

exim -bp | tail -n 30

49. Delete all queued mail from one sender. Found the compromised mailbox? This removes every queued message from that address in one line.

exiqgrep -i -f spammer@example.com | xargs exim -Mrm

50. Force the queue to retry now. After fixing the underlying problem, push legitimate queued mail out instead of waiting for the retry timer.

exim -qff

MySQL and database commands

Most "my website is slow" tickets on a cPanel server end at the database. These four commands cover the daily needs.

51. See running queries live. A query sitting there for 200 seconds is your slowdown. Note its ID and investigate the site that sent it.

mysqladmin processlist

52. Quick health numbers. Uptime, threads, queries per second, slow query count — one line of vital signs.

mysqladmin status

53. Check and auto-repair every database. After a crash or unclean shutdown, this walks all databases and repairs what it can. Takes a while on big servers; let it finish.

mysqlcheck -A --auto-repair

54. Dump a database to a file. Do this before touching any data. Restoring later is one command in reverse (mysql dbname < dbname.sql).

mysqldump database_name > database_name.sql

Security and firewall commands

Almost every cPanel server runs CSF (ConfigServer Security & Firewall). If a client says "I can't reach my site but everyone else can", CSF has blocked their IP after failed logins — it's the most common support ticket in hosting, full stop.

55. Recent failed login attempts. A normal server shows a steady trickle of bots. A wall of attempts on one account means someone specific is being targeted.

lastb | head -n 20

56. Failed SSH logins, with IPs. Same story from the auth log's point of view.

grep "Failed password" /var/log/secure | tail -n 20

57. Is this IP blocked? The first command to run for any "can't connect" ticket. Shows exactly which firewall rule matches the IP.

csf -g 203.0.113.55

58. Unblock an IP. Removes it from the deny list and from temporary blocks.

csf -dr 203.0.113.55

59. Block an IP. For attackers, not customers. The comment shows up in the deny file so future-you knows why. (To whitelist a trusted IP permanently, it's csf -a instead.)

csf -d 198.51.100.23 "wp-login brute force"

Disk space and inode commands

A cPanel server with a full disk fails in strange ways — mail bounces, MySQL corrupts tables, backups silently stop. Same for inodes (the count of files, regardless of size); email accounts with 400,000 tiny messages are the classic inode killer.

60. Disk usage per partition. Anything over 90% on /home or / needs attention today, not this weekend.

df -h

61. Inode usage per partition. The forgotten twin of df -h. 100% inodes with free disk space confuses people every time.

df -i

62. Which account is eating the disk? Sizes every home directory, biggest first. Your answer is on line one.

du -sh /home/* | sort -rh | head -n 15

63. Find giant files anywhere. Forgotten .tar.gz backups and runaway logs, exposed. The 2>/dev/null hides permission noise.

find /home -type f -size +500M 2>/dev/null

Network and DNS checks

"Is it DNS?" It's often DNS. These four commands settle it in under a minute.

64. What does this domain resolve to? If the answer isn't your server's IP, the problem isn't on your server.

dig example.com +short

65. Ask Google's DNS instead. Compares what the outside world sees — the standard propagation check after a DNS change.

dig @8.8.8.8 example.com +short

66. Check a site's response headers. Status code, redirects, server type and cache status without loading the whole page. A 301 loop or a 500 shows up instantly.

curl -I https://example.com

67. Is the network path alive? Four pings to Google's resolver proves basic connectivity when "everything is down".

ping -c 4 8.8.8.8

Backups, archives and moving files

The commands that save careers. For scheduled, restorable, per-account backups we run JetBackup on our own fleet, but manual archives still have their place before every risky change.

68. Compress a folder into one archive. Fast, standard, restorable anywhere.

tar -czf backup-2026-09-01.tar.gz public_html

69. Extract it. Add -C /some/path to extract somewhere specific instead of the current folder.

tar -xzf backup-2026-09-01.tar.gz

70. Copy a file to another server. scp works anywhere SSH works. Great for pulling a backup off the server before dangerous maintenance.

scp backup-2026-09-01.tar.gz root@203.0.113.99:/root/

71. Sync folders between servers. rsync only transfers what changed, survives interruptions and shows progress. This is how real migrations move terabytes.

rsync -avz --progress /home/username/ root@203.0.113.99:/home/username/

Cheat sheet: the 15 commands we use most

Screenshot this table or bookmark the page — it's the short list our support team would grab if they could only keep fifteen.

Command	What it does	When to run it
uptime	Load average, 1/5/15 min	First command on a slow server
top	Live CPU/RAM per process	Finding the resource hog
df -h	Disk usage per partition	Weird failures, before updates
df -i	Inode usage per partition	Disk "full" but space free
tail -f /usr/local/apache/logs/error_log	Live web server errors	Any broken website
grep -i "error" logfile	Search inside any log	Narrowing down a fault
systemctl status httpd	Service state + recent log	Before any restart
/scripts/restartsrv_httpd	Restart Apache/LiteSpeed	Web server stuck
/scripts/upcp	Update cPanel/WHM	Monthly, in a screen session
/scripts/pkgacct user	Full account backup	Before anything risky
exim -bpc	Mail queue count	Spam/blacklist suspicion
mysqladmin processlist	Live database queries	Slow sites, DB suspicion
csf -g IP	Check if an IP is blocked	"Only I can't connect" tickets
du -sh /home/* | sort -rh	Disk usage per account	Full disk hunts
rsync -avz src dest	Efficient file sync	Migrations, offsite copies

Safety rules before you run anything as root

Root access has no undo button. Four habits keep you out of the war stories:

• Back up before you change anything. /scripts/pkgacct for one account, a tar archive for a folder, mysqldump for a database. Thirty seconds of typing versus a very long night.
• Never run a command you can't explain. Especially ones from random forum posts with rm, chmod -R 777 or curl piped into bash. If you don't know what it does, neither does your server — find out first.
• Treat rm -rf like a loaded weapon. Type the path, read it twice, then execute. A misplaced space in rm -rf /home /username deletes every account on the server. That exact typo has ended companies.
• Use screen for long jobs. Start updates with screen -S update, then run /scripts/upcp inside it. If your connection drops, the job keeps running; screen -r update reattaches. Wi-Fi has ruined more server updates than bad RAM ever did.

FAQ: Linux commands and cPanel SSH access

How do I enable SSH access on a cPanel server?

Root SSH is on by default for VPS and dedicated servers — connect with command #1. For individual cPanel users, enable shell access per account in WHM under Account Functions → Manage Shell Access. Individual users land in their own home directory with their own permissions, so most server-level commands here need root.

What's the difference between Linux commands and cPanel commands?

Commands like ls, grep, top and df work on every Linux server on earth. The /scripts/ commands (upcp, pkgacct, restartsrv_httpd) and whmapi1 are cPanel-only — they ship with cPanel/WHM and understand its account structure, config layout and services. A cPanel admin needs both sets, which is why this list mixes them.

Which Linux distribution does cPanel run on?

Current cPanel versions support AlmaLinux 8/9, Rocky Linux 8/9, CloudLinux and Ubuntu LTS. CentOS 7 support ended with its end-of-life. Command #14 tells you what any given box is running.

Can these commands break my server?

Most of the list is read-only — looking at logs, processes and disk usage can't hurt anything. The ones that change state (killacct, rm, csf -d, service restarts) are marked in their descriptions, and the safety section above exists precisely for them. Read-only first, changes second, backups always.

What are the most important SSH commands to learn first?

If you only memorise five: uptime for load, df -h for disk, tail -f for live logs, systemctl status for services and grep for searching. That handful diagnoses probably 70% of everything that goes wrong on a Linux server, cPanel or not.

Do I need my own server to practise these?

You need root, so shared hosting won't cut it. A small VPS is the usual starting point — ours come with WHM/cPanel ready to go and cost less than a pizza per month. If you're building a client base first, reseller hosting gets you WHM without server management, and you can graduate to root later.

Keep this page open

Nobody memorises 71 commands — that's not the point. The point is knowing what exists, so that when the mail queue explodes or the disk fills up, you know there's a one-line answer and roughly where it lives. Bookmark this page, and the next bad day gets a lot shorter.

And if you'd rather have someone else's fingers on the keyboard at 3 AM: our VPS and dedicated servers come with WHM/cPanel, offshore locations in the Netherlands and Romania, and a support team on WhatsApp that actually answers. Talk to us — command line optional.