If you run a reseller hosting business, this scenario probably sounds familiar: a new client signs up, pays, and now you need to get their site live in WHM without stepping on the accounts already sharing that server. It looks like a two-minute job in the interface, but skip one field — a package resource limit, a nameserver, an IP assignment — and you'll be fielding a support ticket about a suspended account or broken email within the week. Here's how to do it properly, and what to check afterward so it doesn't come back to bite you.
Why This Trips People Up
WHM's "Create a New Account" form has more than a dozen fields, and most of them have sane-looking defaults that are wrong for your situation. The account gets created either way — WHM rarely stops you — so the mistakes don't show up immediately. They show up two weeks later as "my emails aren't sending" or "my client says the site is suspended," and by then you've forgotten what you set.
Step 1: Set Up the Hosting Package First
Don't skip straight to account creation. Go to WHM > Packages > Add a Package and define the resource envelope before you ever touch the account form. At minimum, decide:
- Disk quota (in MB) — leave it unlimited only if you genuinely mean it
- Bandwidth — same rule, unlimited should be a deliberate choice, not a default you forgot to change
- Max email accounts, FTP accounts, and databases
- Whether CGI access, shell access, or dedicated IP is included
Reusing one generic "unlimited everything" package for every client is how a single misbehaving account (a compromised WordPress site sending spam, or a runaway cron job) ends up eating resources meant for everyone else on the server. Named packages — starter_1gb, business_5gb, whatever matches your plans — make it obvious at a glance what each client is entitled to.
Step 2: Create the Account
Now go to WHM > Account Functions > Create a New Account and fill in:
- Domain — the client's actual domain, typed correctly (this becomes the account's primary domain and default username seed)
- Username — WHM will suggest one from the domain; keep it short, since some older subsystems still choke on usernames longer than 8 characters
- Password — generate a strong one with the built-in generator rather than typing something you'll need to text the client later
- Email — the contact address for account notices and suspension warnings, not a placeholder
- Package — the one you built in Step 1, not "default"
- Nameservers — usually your own (e.g.
ns1.yourhostname.com,ns2.yourhostname.com) unless the client is keeping DNS elsewhere
Leave "Shared IP Address" selected unless the client specifically needs a dedicated IP for an old-style SSL requirement or a compliance rule — dedicated IPs are a finite resource on the server and shouldn't be handed out by default.
Step 3: Confirm DNS Actually Came Up Right
Once the account exists, don't assume the DNS zone is correct — check it. Open WHM > DNS Functions > Edit DNS Zone, pick the new domain, and verify:
- The
Arecord for the bare domain andwwwpoint to the server's actual public IP - An
MXrecord exists (WHM adds one automatically for local mail, but double-check if the client plans to route email through Google Workspace or Microsoft 365 instead) - The
ns1/ns2glue records resolve if this is the first account using your custom nameservers on that domain's TLD
If the client is keeping DNS at their existing registrar or a service like Cloudflare, skip WHM's nameservers entirely and just hand them the A record and MX record to enter on their end instead.
Common Mistakes and What They Break
| Mistake | What Breaks | Fix |
|---|---|---|
| Reusing an "unlimited" package for every account | One heavy account starves CPU/RAM for others (LVE limits get hit constantly) | Create tiered packages with real disk/bandwidth/entry-process caps |
| Typo in the domain field during creation | Wrong DocumentRoot, SSL cert issued for the wrong name | Delete and recreate the account — renaming later is messier than starting over |
| Forgetting to set a contact email | Client never sees quota-exceeded or suspension warnings until the site is already down | Always fill in a real, checked email address |
| Assigning a dedicated IP "just in case" | Server runs out of available IPs faster than expected | Only assign dedicated IPs when there's a documented reason |
| Not checking AutoSSL after creation | Site shows "Not Secure" until the next AutoSSL run, hours later | Run AutoSSL manually from WHM once DNS has propagated |
Prevention: Keep the Server Healthy as You Scale
A handful of habits save most of the pain later:
- Review WHM > List Accounts monthly and sort by disk/bandwidth usage — spot the accounts creeping toward their limits before the client notices a suspension
- Set realistic overage/suspension thresholds in WHM > Suspend/Unsuspend an Account policies rather than letting the server hard-suspend without warning
- If you're billing through WHMCS or similar, make sure package names in WHM match your billing product mapping exactly — mismatches cause accounts to sync with the wrong resource limits
- Keep a "quarantine" package with tight limits for trial or unpaid accounts, so a stalled signup doesn't quietly consume full resources indefinitely
None of this is complicated once you've done it a few times — it just rewards being deliberate about the package and DNS steps instead of clicking through the defaults.
Frequently Asked Questions
Can I change a cPanel account's package after it's created?
Yes — go to WHM > Upgrade/Downgrade an Account, pick the account, and select the new package. Existing data isn't affected; only the resource limits change. If the account is currently over the new package's limits, WHM will still apply it, but the account may hit suspension warnings immediately.
What happens if I delete the wrong account?
WHM's account termination is destructive — it removes the home directory, databases, and email unless you've taken a backup first. If JetBackup or a similar backup system is active, you may be able to restore from the most recent backup, but always confirm a backup exists before terminating anything.
Why does the new account still show the old server's IP in DNS?
This usually means the domain's authoritative nameservers still point elsewhere — WHM only controls DNS for domains actually using its nameservers. If the client's domain is using their registrar's default DNS or a third-party service, you'll need to update the A record there manually instead.
Do I need a dedicated IP for SSL to work?
No. Modern AutoSSL and Let's Encrypt certificates work fine on shared IPs via SNI, which every current browser supports. Dedicated IPs are only needed for a small number of legacy compliance or older-client-software cases.
How many accounts can one WHM server realistically host?
There's no fixed number — it depends entirely on your packages' resource limits versus the server's actual CPU, RAM, and disk. A server hosting fifty lightweight brochure sites behaves very differently from one hosting ten resource-heavy WooCommerce stores. Watch WHM > Server Status > Service Status and load averages rather than going by account count alone.
