GICT knowledge base
How to Enable Leech Protection in cPanel?
Published
The Leech Protection interface on cPanel is very useful for preventing users from publicly posting their username and password. Leeching occurs when users publicly post their username and password and the unauthorized users use their credentials to access the secure areas of the web site. By using the cPanel leech protection feature, we can prevent leeching. This can be done when you set the utmost range of logins within a two-hour period, the system redirects them to another URL or send an e-mail alert or suspend users who exceed the login limit. Please follow the below-given steps to enable leech protection on your account.
1) Log in to your cPanel account.
2) Select the ‘Leech Protection’ option under the ‘Security’ section.

3) A directory selection window will open and here you can select the directory for which you want to intend protection.
4) On the next page, you can enter the maximum number of logins which you want to allow for each user within a 2-Hour period of time.

5) In order to redirect users who exceed the maximum number of logins within a two-hour period, enter a URL to the ‘URL to Redirect Leech Users to’ box. It will redirect the users to the corresponding URL.

6) If you want the system to send an email alert when Leech Protection activates, then select the ‘Send Email Alert To’ checkbox and enter the email address to which the alert should be sent.

7) Choose the option Disable Compromised Accounts checkbox, if you want to disable an account which exceeds the maximum number of logins.

8) Finally, click on the ‘Enable’ button at the bottom to enable the Leech Protection.
If you need any further help, please do reach our support department.
Related guides
Host Additional Domains on an Eligible InterServer Account
Check your hosting limits, choose a separate site or alias and use cPanel or DirectAdmin with deliberate DNS, content and certificate verification.
cPanelHardening Your cPanel Server: Beyond the Basics After CVE-2026-41940
Security is a moving target. With the recent discovery of CVE-2026-41940, it has become clear that just having a firewall isn't enough anymore.
cPanelcPanel and Plesk notice: Awstats,. Webalizer and Analog stats are being removed
Important Update: cPanel and Plesk Phasing Out Legacy Statistics Tools If you regularly check your website traffic through your hosting control panel, we have an...
cPanelThe dangers of shared licenses (in other words unofficial/cracked licenses)
Why Cracked cPanel Licenses Aren’t Worth the Risk: A Guide for InterServer Customers When you’re managing a server, every dollar counts.
