(Home >> Security Center >> Apache mod_userdir Tweak)
This interface allows you to disable the Apache
mod_userdir module's functionality for your users.
mod_userdir module allows for visitors to access a user's website via a URL that contains that user's username. For example:
https://host.example.com/~username https://example.net/~username https://192.168.0.20/~username
Most servers use the Apache
mod_userdir module as a temporary URL system that allows users to view their websites. This temporary URL system functions even if the system does not possess configured DNS or the domain does not yet point to the server.
When you enable the Apache
mod_userdir access, perform the following steps:
mod_userdir functionality for specific hosts, select the appropriate Exclude Protection checkboxes.
This action allows all users to access content on the host via the Apache
mod_userdirfunctionality for specific additional users to access these hosts, enter their usernames in the Additional Users text box.
To allow your users to access their own accounts through the
Do not select the Exclude Protection checkbox on a user's domain if you only wish to allow an individual user to access their site with a
You own the following three cPanel accounts:
Arthur’s domain resolves, but Betty’s and Charles’ domains do not yet resolve.
mod_userdir protection for the server to deny one user the ability to use another user's bandwidth, select the Enable mod_userdir Protection checkbox.
However, if you still want to allow Betty and Charles to use Arthur’s domain to see their sites, perform the following steps:
betty charlesin the Additional Users text box.
Betty and Charles can browse their sites with the following URLs:
If a shared SSL certificate exists for a virtual host on a shared IP address, you can share that SSL certificate with users on the same IP address. This allows users to access their sites securely without a browser warning.
For example, if an SSL certificate exists on
host.example.com, select the Exclude Protection checkbox for the DefaultHost (nobody) host. This allows the
username cPanel user to access the
We strongly recommend that you restrict
mod_userdir functionality for most of your users.
mod_userdir can expose potential security issues.
mod_userdir, then the server will not record their bandwidth usage correctly. This can also potentially allow for one user to use the bandwidth of another.
When you disable
mod_userdir protection for a host, we recommend that you do not exclude the entire host, but rather exclude only specific users via the "Additional Users" field.
Before you enable the Apache
mod_userdir module, be aware of the following information:
Java servlets do not work with
mod_userdir-based URLs. This is because Tomcat requires you to add additional directives to the virtual host.
EasyApache 3 does not support Tomcat for new installations. EasyApache 4 does not support Tomcat and we do not plan to provide support in the future.
The CGI, FastCGI, and PHP-FPM PHP handlers do not allow you to use the Apache
mod_userdir module. Select the tabs below for directions on how to use this module:
open_basedir protection restricts PHP's access to the home directory of the user who owns the base domain, not the home directory of the user account that a visitor accesses. If you enable
open_basedir protection in WHM's Apache mod_userdir Tweak interface (Home >> Security Center >> PHP open_basedir Tweak), visitors cannot access some sites via the
Websites that use the
mod_rewrite or other directives in their
.htaccess files will not function correctly when visitors view them through
If you enable Apache's
mod_ruid2 module, then the
mod_userdir module will not function correctly. For more information, read our Apache mod_userdir Tweak documentation.
Under certain conditions, a user can attack another user's account if they access a malicious script through a
The following table describes when the Symlink Race Condition Protection option blocks
|The requested URL includes a file and does not belong to the owner of the file.||Blocked.|
|The requested URL includes a file and an IP address that belongs to another account.||Blocked.|
|The requested URL contains a directory.||Not blocked.|
|You wish to access the server's hostname.||Not blocked.|
Before you disable
mod_userdir protection, be aware of the following information:
mod_userdirfunctionality, it does not remove the module itself. Some PCI compliance scans may still detect it.
mod_userdirmodule uses virtual hosts.
mod_userdirmodule in most cases.
If you attempt to provide protection on a dedicated IP address, the site's contents will still display when protection is enabled. To disable this behavior, open the
/etc/apache2/conf.d/includes/post_virtualhost_global.conf file with a text editor and add the following line: