Most people use cPanel for three things: File Manager, phpMyAdmin, and creating an email account. The other forty-odd icons sit there for years, unclicked.

Which is a shame, because several of them answer the exact questions people open support tickets about — why is my site slow, why can I not upload a file, where did that email go. Here are the ones worth learning, roughly in order of how often they turn out to matter.

1. Resource Usage — the one that explains "my site is slow"

Metrics → Resource Usage. This is the most useful screen in cPanel and the least visited.

It shows your account's actual consumption against your plan's limits: CPU, physical memory, I/O, and entry processes, plotted over time. If your host runs CloudLinux — and a good one does — this is a live readout of the ceilings that decide your performance.

What to look for:

  • Repeated faults on entry processes means visitors were being queued or refused. Each entry process is one concurrent PHP request, so a low ceiling is what turns a small traffic spike into a 503.
  • CPU pinned at 100% during specific hours points at a cron job, a bot, or a plugin doing work on every page load.
  • I/O faults with normal CPU usually means a plugin writing to the database on every page view — statistics plugins are the classic offender.

Before you buy a bigger plan, look here. It tells you whether you have a hosting problem or a WordPress problem, and those have very different solutions.

2. Inode usage — "I cannot upload anything, but there is space free"

Somewhere in the sidebar, cPanel shows File Usage or Inodes. An inode is one file, regardless of size, and almost every plan caps them.

This is why an account with 3 GB free can suddenly refuse to write anything. The usual causes:

  • Old email in webmail. One message is one file. Years of a busy inbox is hundreds of thousands.
  • Cache directories. Some caching plugins generate a file per page per device type and never clean up.
  • Backups stored in your own home directory — which is both an inode problem and a bad backup strategy.
  • node_modules uploaded to the server. Tens of thousands of files for one small app.

Check it before it becomes the reason a customer cannot submit a form.

3. Backup Wizard, and why you still need your own

Files → Backup or Backup Wizard downloads a full account backup — files, databases, email, DNS zones, everything — as a single archive.

Your host almost certainly takes backups too. Take your own anyway, because they protect against different things: the host's backups protect you from the host's failures; yours protect you from a bad deploy nobody noticed for a fortnight, and from losing access to the account.

Two habits worth having:

  • Download a full backup before any big change — a theme swap, a PHP version jump, a plugin update on a busy site.
  • Actually open one occasionally. An archive you have never extracted is a belief, not a backup.

4. MultiPHP Manager and the PHP selector

Software → MultiPHP Manager sets the PHP version per domain. MultiPHP INI Editor changes settings like memory_limit, upload_max_filesize and max_execution_time without touching a file.

Two things this solves immediately:

  • "The file is too large to upload." Raise upload_max_filesize and post_max_size. Raising only the first is the most common reason the error does not go away.
  • A site that breaks on a newer PHP. Move back one version, confirm the site returns, then fix the plugin. Being able to revert in fifteen seconds is what makes upgrading safe — see speeding up WordPress, where updating PHP is step two.

Also here: Select PHP Version → Extensions, when an application complains about a missing extension. It is usually one checkbox, not a support ticket, and if you would rather not test that yourself, our shared hosting sets CloudLinux limits per account and runs on NVMe.

5. Cron Jobs — and the WordPress one nobody sets

Advanced → Cron Jobs runs a command on a schedule.

The single most valuable one for WordPress users: WordPress's built-in "cron" is not a real scheduler. It fires when somebody visits the site, which means scheduled posts do not publish on a quiet night and backups run late. Fix it by disabling the fake one and using a real one:

php
// wp-config.php
define( 'DISABLE_WP_CRON', true );
bash
# cPanel cron, every 15 minutes
wget -q -O - https://yoursite.com/wp-cron.php?doing_wp_cron >/dev/null 2>&1

That change alone makes scheduled publishing reliable and takes a small amount of work off every page load.

⚠ Do not schedule anything every minute on shared hosting. It is the fastest way to hit the CPU limits in point 1.

6. Redirects — without touching .htaccess

Domains → Redirects writes the rule for you. Use it for a moved page, a marketing short link, or forcing www one way or the other.

Two rules worth knowing:

  • Permanent (301) tells search engines the move is final and passes the ranking signal on. Temporary (302) does not. Choose deliberately — a 302 on a permanent move quietly costs you the page's authority.
  • Redirect chains cost time. A → B → C is two extra round trips for every visitor. Point A at C directly.

7. Track Delivery — "did my email actually send?"

Email → Track Delivery is the answer to the most common and most frustrating hosting question there is.

Search for a recipient address and it shows exactly what happened: delivered, deferred, bounced — and, critically, the receiving server's own error message. That message usually names the real problem: an SPF failure, a full mailbox, a spam-score rejection.

This turns "our emails are not arriving" from a mystery into a specific fixable fault, usually in under a minute.

8. Email Authentication — the reason mail goes to spam

Email → Email Deliverability (or Email Authentication) shows the DNS records that prove your mail is genuinely yours: SPF, DKIM and increasingly DMARC.

If cPanel flags a problem here, fix it before anything else. In 2026 the major mailbox providers enforce authentication seriously, and a domain without it will find its invoices and password resets landing in junk folders — not occasionally, but as a rule.

cPanel will usually offer to repair the records itself. If your DNS is at Cloudflare rather than the host, you have to copy them across by hand — a common cause of mail breaking after a Cloudflare migration.

Security → IP Blocker blocks an address or a range. Genuinely useful for a persistent scraper or a specific abusive IP. Not a substitute for a firewall — attackers rotate addresses — but a decent immediate response.

Hotlink Protection stops other sites embedding your images while your bandwidth pays for them. If your image traffic looks disproportionate to your page views, this is usually why.

10. Leech Protection

Almost nobody knows this exists. It watches for one password being used from many places at once — the signature of a shared or sold login — and suspends the account.

Useful for any site with paid accounts or member areas.

11. Error Log and Raw Access

Metrics → Errors shows the last few hundred web-server errors. Raw Access downloads the full logs.

This is the difference between "the site is broken" and "the site throws a fatal error in that plugin's file on line 412". When you do open a support ticket, including the actual error turns a three-message exchange into one.

12. cPanel's own Terminal

Advanced → Terminal, when your host enables it, gives you a real shell in your account. Not root, but enough for WP-CLI, git, composer, and searching files properly.

If you are comfortable on a command line this is the single biggest quality-of-life feature in cPanel:

bash
wp plugin list --status=active   # what is actually running
wp db export backup.sql          # a real database backup in one line
du -sh */ | sort -h              # what is eating the disk
find . -name "*.php" -mmin -60   # PHP files changed in the last hour

That last one is a quick check for a compromise — recently modified PHP files in an uploads directory are a bad sign. For the rest of that argument, see securing a Linux server.

A short maintenance routine

Fifteen minutes a month, and most hosting surprises stop being surprises:

  1. Resource Usage — any faults this month?
  2. Inode usage — trending toward the limit?
  3. Disk usage — what grew, and why?
  4. Download a full backup, and keep three.
  5. Email Deliverability — still green?
  6. Error log — anything repeating?
  7. SSL status — everything renewed, including www?

Two things worth turning off

Most of this article is about features to start using. Two are worth deliberately switching off.

Default address (the catch-all). By default, mail to any address at your domain that does not exist is delivered somewhere rather than rejected. That sounds helpful and is not: spammers enumerate addresses, and a catch-all accepts every one of them. Your inbox fills with mail for accounts that never existed, and your domain's sending reputation suffers from the bounces you generate in reply. Set the default address to Discard, and create the addresses you actually want.

Directory indexing. If a directory has no index file, the server lists its contents. That is how people discover your backup folder, your old /test directory and the SQL dump somebody left in /tmp two years ago. Turn indexing off in the Indexes icon, globally.

Neither is a dramatic security measure. Both close a door that should never have been open, and both take under a minute.

When to stop using cPanel and open a ticket

There is a line, and knowing where it is saves everyone time.

Handle it yourself: disk and inode usage, backups, redirects, PHP version and settings, cron jobs, email accounts and forwarders, SSL status, and reading your own error logs. All of these are in the panel, and a ticket asking about them is slower than looking.

Open a ticket for: anything requiring root, a suspected server-level problem (the whole machine slow, not just your account), IP blocks affecting you from outside, mail rejected by a remote server for a reason you cannot see, and anything where you have read the error and still do not know what it means.

When you do open one, include three things: what you did, what you expected, and the exact error text — copied, not described. Adding the relevant lines from Metrics → Errors turns a three-message exchange into a single reply, and it is the difference between a fix this afternoon and a fix tomorrow.

Frequently asked questions

Why does cPanel say my disk is full when I have space? Almost always the inode limit — the count of files, not their size. Old webmail messages and cache directories are the usual causes. Look for "File Usage" or "Inodes" in the sidebar.

How do I find out why my site is slow from cPanel? Metrics → Resource Usage. It plots CPU, memory, I/O and entry processes against your plan's limits. Faults there mean the plan is the constraint; no faults means the problem is in the site.

Can I back up my whole cPanel account? Yes — Backup Wizard produces a full archive of files, databases, email and DNS. Do it before any significant change, and keep a copy somewhere other than the server.

Why are my emails going to spam? Check Email Deliverability first. Missing or broken SPF, DKIM or DMARC records are the leading cause, and cPanel can usually repair them in one click — unless your DNS is hosted elsewhere, in which case copy the records across by hand.

Is cPanel Terminal the same as SSH? It is a shell in your own account, without root. Enough for WP-CLI, git and file work; not enough to install system packages. Some hosts disable it, and some require you to enable SSH access first.

Should I use cPanel's own backups or the host's? Both. They fail differently. The host's protect you from infrastructure problems; yours protect you from your own mistakes and from losing account access.