WHM Feature Manager Tutorial (2026): Control cPanel Access Without Breaking Reseller Plans

Most WHM admins ignore Feature Manager until something goes wrong. A client spots a tool they shouldn't have. Or a reseller asks for a stripped-down cPanel on budget plans.

That's usually when someone discovers the default feature list has sat untouched for two years — applied to every account on the server.

Feature Manager controls which icons, tabs, and functions show up inside a client's cPanel. It's separate from Package Restrictions, which caps disk space, bandwidth, and resource usage. Feature Manager only handles visibility and access.

Get it wrong and you expose tools clients shouldn't touch, like MultiPHP INI Editor or SSH Access. Or you hide something they actually need, like Softaculous or the Email Deliverability tool.

This tutorial covers building custom feature lists, attaching them to hosting packages, and auditing what's currently exposed on your server. If you run a reseller hosting business, the WHM Feature Manager is one of the higher-leverage settings you can tune. It directly shapes how clients perceive your plan tiers.

What the WHM Feature Manager Actually Controls

Feature Manager lives inside WHM under Packages. It manages roughly 100+ individual cPanel features, from File Manager and Cron Jobs to more sensitive items like Terminal, SSH Access, and Change MX Entry. Each feature can be enabled, disabled, or left at its default state.

Three things determine what a client actually sees:

• The feature list assigned to their account
• Their package and any package-level restrictions
• Their ACL/reseller permissions, if they're a reseller account

A common mistake: admins edit the default feature list and assume it applies everywhere. It doesn't.

Feature lists only apply to accounts explicitly assigned to them, either directly or through a package. Accounts created before the change keep whatever list they had at creation time, unless you update them manually.

Step 1: Review What's Currently Enabled

Before changing anything, audit the existing setup. Log into WHM and go to Packages > Feature Manager. You'll see a dropdown for existing feature lists, usually default and Mail Only if you've never customized this before.

Click default and scroll through it. Pay close attention to these high-risk items:

• Terminal — full shell access inside the browser, dangerous on shared plans
• SSH Access — should generally stay off for shared/basic tiers
• Change MX Entry — clients messing with this can break email delivery; worth reviewing alongside your email bounce troubleshooting guide if clients report mail issues after touching this
• MultiPHP INI Editor — lets clients override PHP settings per-domain, which can bypass your EasyApache defaults
• Softaculous / Installatron — keep this on for WordPress-focused plans

Run a command-line check too. SSH into the server and inspect which feature lists exist on disk:

ls -la /var/cpanel/features/

Each file is a feature list. Cat one to see its raw contents:

cat /var/cpanel/features/default

You'll get output like terminal=0 or sshaccess=0, one line per feature. A value of 0 disables it, 1 enables it. A missing entry means it inherits the cPanel default, usually enabled.

Step 2: Create a Custom Feature List

Don't edit default directly if you're running multiple plan tiers. Clone it instead and build tier-specific lists. In Feature Manager:

1. Click Add a Feature List
2. Name it something descriptive, like shared-basic or reseller-standard
3. Save, then click into the new list to configure it

For a basic shared hosting tier, a reasonable starting point looks like this:

• Terminal: Disabled
• SSH Access: Disabled
• Change MX Entry: Disabled
• Track DNS: Enabled
• Softaculous Apps Installer: Enabled
• Backup / Backup Wizard: Enabled
• MultiPHP Manager: Enabled (view only, not INI editing)
• Cron Jobs: Enabled

For a higher reseller tier where clients are developers, you might re-enable SSH Access and Terminal. Keep MX editing locked, though, to avoid deliverability accidents.

This tiering approach pairs well with the resource-side controls in our WHM package restrictions guide, since feature access and resource limits usually move together across plan tiers.

Step 3: Attach the Feature List to a Package

Feature lists don't do anything until they're tied to a hosting package. Go to Packages > Add a Package, or edit an existing one under Edit a Package.

Inside the package editor, scroll to the Feature List dropdown and select your custom list — for example, shared-basic. Save the package.

One catch: this only affects new accounts created with that package, or existing accounts you update manually. To push the change to existing clients on that package, use WHM's bulk feature list update, or update accounts one at a time under List Accounts > Modify.

For bulk changes from the command line, script it with whmapi1:

whmapi1 modifyacct user=clientuser FEATURELIST=shared-basic

Loop that inside a bash script reading a list of usernames if you're migrating dozens of accounts to a new tier structure at once.

Step 4: Verify From the Client Side

Log into a test cPanel account (or impersonate one from WHM's account list) and confirm the interface matches expectations. Check specifically:

• Does Terminal appear under Advanced? It shouldn't for shared tiers.
• Is SSH Access visible under Security?
• Can the client still reach Softaculous under Software?
• Are cron jobs and file manager both accessible?

If something looks off, don't guess. Check the actual feature file again with cat /var/cpanel/features/shared-basic and compare it line by line against what WHM's UI shows. Occasionally the UI lags behind the file — a quick /scripts/rebuildhttpdconf or cPanel service restart usually clears up display inconsistencies.

Common Feature Manager Mistakes

A short diagnostic list, based on patterns that show up repeatedly across cPanel servers:

• Leaving Terminal enabled by default. New cPanel installs sometimes ship with Terminal on. Audit this immediately after provisioning any new VPS hosting box you plan to run cPanel on.
• Assuming default list changes apply retroactively. They don't. You have to reassign existing accounts manually.
• Disabling AutoSSL-related features by accident. If clients can't see SSL/TLS Status, they can't self-diagnose certificate issues. That just lands on your support queue. Cross-reference with our AutoSSL troubleshooting tutorial before hiding SSL tools entirely.
• Confusing Feature Manager with ACLs. Reseller-level restrictions — what a reseller can grant their own clients — live in a different section: Resellers > Reseller Center.
• Forgetting DNS-related features on multi-server setups. If you're running secondary DNS as described in our BIND9 DNS slave setup guide, make sure Zone Editor access lines up with which server actually holds the authoritative records.

Feature Manager vs. Package Restrictions: Quick Comparison

Aspect	Feature Manager	Package Restrictions
Controls	What tools/tabs appear in cPanel	Disk, bandwidth, CPU, email limits
Where configured	Packages > Feature Manager	Packages > Add/Edit Package
Applies retroactively?	No, must reassign accounts	Yes, on package edit for linked accounts
Typical use case	Hiding SSH/Terminal from budget plans	Preventing one client from consuming shared server resources

Review both settings together whenever you build a new plan tier. Feature Manager shapes the experience; package restrictions protect the server.

FAQ

Does changing a feature list log clients out of cPanel?

No. Feature list changes take effect on next page load or login. Active sessions may show stale menus until the client refreshes or logs back in.

Can I set different feature lists per domain instead of per account?

No. Feature lists apply at the cPanel account level, not per-domain. If you need per-domain differences, you'll need separate accounts or reseller-level ACL adjustments.

Will disabling a feature delete data associated with it?

No. Disabling, say, Cron Jobs hides the interface but doesn't touch existing cron entries. They keep running — the client just can't manage them through cPanel until you re-enable access.

How do I find which feature list an account currently uses?

Run whmapi1 accountsummary user=USERNAME and look for the featurelist field in the output, or check WHM > List Accounts > Modify for that user.

Should I disable File Manager for security reasons?

Generally no. Clients need it for basic file management. Disabling it just pushes them toward FTP/SFTP instead, which isn't any safer. Focus hardening efforts on Terminal and SSH Access, and pair that with the practices in our server hardening tutorial for the underlying VPS.