Understanding cPanel Analytics and the Data It Uses

1. What Is cPanel Analytics?

cPanel Analytics is a system that collects data about how users interact with cPanel, WHM, and Webmail, as well as how the server is configured and used. This information helps WebPros make better product and infrastructure decisions, improve the user experience, and understand how features perform in real environments. The data model is designed so that it does not include private, personal, or security-sensitive information, and analytics data is retained for a limited period before it is removed.

2. Interface Analytics

Interface Analytics focuses on how users navigate and use the interfaces of cPanel, WHM, and Webmail. It tracks behavior inside the UI, such as which sections users visit, how often they log in, and which features they rely on. This helps identify popular tools, discover friction points in workflows, and guide interface improvements without inspecting the actual content hosted on accounts.

2.1 Behavior in newer versions

In newer versions of cPanel & WHM, such as version 110 and 126 and later, personal and security-related details are removed from every step of the analytics pipeline. The Interface Analytics plugin is typically installed and enabled automatically, while direct interface options for managing it may be disabled to keep the configuration consistent. The goal is to collect useful usage data while minimizing the risk of exposing sensitive information.

2.2 Behavior in earlier versions

In earlier versions, such as 118 and before (excluding version 110), Interface Analytics is more opt-in. The plugin is installed by default but not enabled automatically. Both the server owner and individual accounts can decide whether to participate. Data collection depends on settings at the server level and the account level working together.

2.3 Server and account level participation

The effective state of Interface Analytics is determined by a combination of server and account preferences:

• Server: Yes / Account: Yes → Enabled
• Server: Yes / Account: No → Disabled
• Server: No / Account: Yes → Disabled
• Server: No / Account: No → Disabled

If neither the server owner nor the user enables the plugin, the system only records whether the server owner has turned the plugin on at the server level, without collecting detailed interface usage data.

2.4 What Interface Analytics collects

The Interface Analytics plugin gathers high-level technical and behavioral information, such as:

• The cPanel & WHM product version running on the server
• The operating system and its version
• The account’s UUID (Universally Unique Identifier)
• Whether the account is a cPanel, WHM, or Webmail account
• Company and license identifiers used for partner and license management
• Interface style and theme for cPanel or Webmail accounts
• Whether Webmail logins originate from the Webmail login page or from a redirect in the cPanel interface
• How frequently users access cPanel, WHM, and Webmail
• How often root users or resellers use elevated privileges to access user accounts
• The types of devices used to access the interfaces
• Usage of specific features and supported locales
• How often mailing list users and administrators access mailing list configuration
• How many users access Roundcube, which paths they follow, and what tasks they perform

3. Configuration Analytics

Configuration Analytics is a separate component that focuses on server configuration, installed features, and operational metrics. Unlike Interface Analytics, participation in Configuration Analytics is always required. WebPros classifies this data as operational, meaning it is essential for making critical business and technical decisions, such as understanding deployment patterns, planning updates, and improving stability.

3.1 How Configuration Analytics works

Configuration Analytics collects data from various configuration files, internal settings, and feature-specific sources. For example, it reads values from the cpanel.config file and from WHM’s Tweak Settings interface. It also gathers information about updates by packaging logs whenever the /usr/local/cpanel/scripts/upcp script runs. These logs are bundled into a tarball and sent for analysis using a helper script such as gather_update_log_stats.

3.2 Types of configuration data collected

The scope of Configuration Analytics is broad and can include:

• Account distribution, such as how many accounts manage 0, 1, 2, or many domains
• Counts of cPanel, Web Disk, FTP, and email accounts
• Usage of team features, including team_owner, team_user, and assigned roles
• API usage metrics, such as the number of API calls and pages that rely on specific APIs
• Database engine versions and whether remote database servers are used
• DNS clustering roles and the number of servers in each role
• Email statistics, including delivery counts, rejections, spam filtering, and quotas
• Security-related configuration such as SpamAssassin, DMARC, and Greylisting settings
• Hostname configuration, IP addresses, and environment details
• Plugin availability and usage for features like 360 Monitoring, Search Engine Optimization, Sitejet Builder, and social media tools

3.3 Example: 360 Monitoring data

For the 360 Monitoring plugin, Configuration Analytics may collect values such as:

• How many cPanel, Webmail, and WHM users can use the plugin
• Whether commerce integration is available and enabled
• The status of the monitoring agent and its server ID
• Whether the plugin is installed, usable, enabled, or disabled locally

4. Privacy, retention, and purpose

Both Interface Analytics and Configuration Analytics are designed with privacy in mind. The system avoids collecting private content or sensitive personal data and focuses instead on technical and behavioral metrics. Data is retained for a defined period, such as 26 months, and then removed. This balance allows WebPros to improve products and infrastructure while respecting user privacy and regulatory expectations.

5. Why this data matters

The data collected by cPanel Analytics helps answer important questions: which features are most used, how servers are configured in the real world, where performance or reliability issues appear, and how new tools are adopted. Interface Analytics provides insight into user behavior in the UI, while Configuration Analytics offers a deeper view into server setups and operational patterns. Together, they support better decisions, more stable releases, and a smoother experience for hosting providers and end users.

Conclusion

cPanel Analytics is built around two complementary components: Interface Analytics for understanding how users work inside the interface, and Configuration Analytics for understanding how servers are configured and used. While interface tracking can depend on consent and configuration, configuration data is always collected as operational information. By focusing on non-sensitive metrics and enforcing retention limits, the system aims to deliver meaningful insights without compromising user privacy.

15. ACL Usage Data

The Configuration Analytics system also collects information about how default Access Control Lists (ACLs) are used within cPanel & WHM. These insights help administrators understand which permissions are most frequently applied and how access patterns evolve across different environments.

16. API Activity Metrics

To better understand automation and integration behavior, Configuration Analytics gathers detailed statistics about cPanel API 1 usage. These metrics highlight how often scripts, plugins, and third‑party tools interact with the system.

16.1 API Usage Types

• api1_calls: Total number of API 1 function calls executed on the server
• api1_pages: Number of interfaces that include API 1 functions
• number_of_users_with_tokens: Accounts currently using API Tokens

16.2 Reseller Accounts Without Domains

When reseller accounts are created without an associated domain using the createacct function in WHM API 1, the system records:

• total_created: Total number of such accounts
• Year‑based fields showing how many accounts were created in each specific year

17. Configuration File Data

Configuration Analytics collects information from several key configuration files to provide a complete picture of the server’s environment.

17.1 The cpanel.config File

This file contains core system settings, and its full contents are included in analytics to help identify configuration patterns across servers.

17.2 The cpsources.conf File

• MYIP: URL used to determine the server’s public IP address
• NEWS: Legacy address used for retrieving WHM news

17.3 The sysinfo.config File

• rpm_dist: Linux distribution name
• ises: Whether the server uses Red Hat Enterprise Linux
• rpm_dist_ver: Distribution version
• rpm_arch: System architecture
• release: Release number

17.4 The allowstupidstuff File

• enabled: Whether the file exists
• users_with_leading_digit: Number of usernames beginning with a digit
• total_users: Total number of system users

18. cPAddons Data

The system also tracks information about cPAddons installed on the server, including:

• Name of each addon
• Total installations
• Number of up‑to‑date installations
• Whether users are allowed to install the addon

19. cPHulk Security Configuration

Security‑related data is collected from cPHulk using the load_cphulk_config function. This helps identify how brute‑force protection is configured across servers.

20. Database Environment Metrics

Configuration Analytics gathers extensive information about MySQL, MariaDB, and PostgreSQL environments to understand database usage and compatibility.

20.1 MySQL Data

• userstat: Whether MySQL user statistics are enabled
• users_with_old_passwords: Number of accounts using outdated password formats
• mysql_db_version: Full MySQL version

20.2 Remote Database Information

• is_local: Whether the database server is local
• address: Host and port of the remote server
• setup_with_ssh: Whether SSH was used during setup

20.3 PostgreSQL Data

• installed: Whether PostgreSQL is installed
• postgres_db_version: Full PostgreSQL version

20.4 Database Statistics

• count: Total number of databases
• max: Size of the largest database
• mean: Average database size
• median: Median database size
• mode: Most common database size
• std: Standard deviation of database sizes

21. DNS Clustering Data

To analyze DNS infrastructure, the system collects:

• members: Number of servers in the DNS cluster
• standalone: DNS servers operating independently
• write_only: Servers configured as write‑only
• sync: Servers in synchronization mode
• reseller_clusters: Resellers with DNS clustering enabled

22. Domain Information

• domain: Domain name
• web_locallyhosted: Whether the domain is hosted locally

23. EasyApache 4 Data

• easyapache_version: Installed EasyApache version
• easyapache4_packages: List of EA4 packages available on the server

24. Email, Calendars, and Contacts Metrics

The Configuration Analytics system collects extensive data about email activity, mailbox usage, and authentication behavior. These insights help administrators understand how email services are being used and how server resources are consumed.

24.1 Email Account Statistics

• email_users_previous_day: Number of users who logged into Dovecot during the previous day, including IMAP and Webmail sessions
• system_user_cnt: Total number of system-level email accounts
• min_quota: Smallest mailbox quota assigned to any account
• max_quota: Largest mailbox quota assigned to any non‑unlimited account
• mean_quota: Average mailbox quota across all accounts (excluding unlimited quotas)
• median_quota: Median mailbox quota (excluding unlimited quotas)
• unlimited_quota_cnt: Number of accounts with unlimited quota
• set_quota_cnt: Number of accounts with a defined quota
• total_quota_available_for_mail: Total available storage allocated for email
• roundcube_usage: Number of users who accessed Roundcube during the last day

24.2 Email Message Activity

• delivered_to_local: Total number of messages delivered to local mailboxes
• sent_to_local: Messages sent locally between accounts on the same server
• sent_to_remote: Messages sent to remote mail servers
• rejected: Messages rejected by the server
• total_storage_used_for_mail: Total disk usage consumed by stored email

24.3 Exim Log Insights

Data extracted from /var/log/exim_mainlog provides a detailed view of message delivery behavior:

• sent_ok_codes: SMTP status codes for successfully delivered messages
• sent_ok : routers: Routers responsible for successful deliveries
• sent_ok : transports: Transports used for successful deliveries
• send_failures: Number of failed delivery attempts
• failed_send : retrytimeout: Messages that exceeded retry timeout
• failed_send : routers: Routers involved in failed deliveries
• failed_send : transports: Transports involved in failed deliveries
• smtp_root_host_connections: Root domains used by SMTP clients
• total_email: Total number of emails processed in the last 24 hours

25. SpamAssassin Activity

The system gathers detailed statistics about Apache SpamAssassin to evaluate spam filtering performance.

• sa_accounts: Accounts with SpamAssassin enabled
• spambox_accounts: Accounts using Spam Box
• scanned: Emails scanned in the last 24 hours
• not_scanned: Emails not scanned
• scored_spam: Emails flagged as spam
• scored_not_spam: Emails marked as clean
• scores: Spam score distribution and frequency
• total_custom_global_rules_files: Number of global custom rules
• total_custom_user_rules_files: Number of user-level custom rules
• has_custom_local_cf: Whether a custom local.cf file exists

26. DMARC and MX Record Data

To analyze domain-level email authentication and routing, the system collects:

• number_of_domains_with_dmarc: Domains with DMARC DNS records
• remote_mx: Domains using remote mail servers
• mx_type : number_of_gapps: Domains using Google Workspace
• mx_type : number_of_o365: Domains using Microsoft 365

27. Greylisting Metrics

Greylisting behavior is tracked to evaluate spam prevention efficiency.

• is_enabled: Whether Greylisting is active
• trusted_hosts: List of trusted domains
• total_number_of_domains_on_server: Total domains hosted
• possible_spam_count: Emails flagged as potential spam
• triplets_deferred_count: Deferred messages due to Greylisting
• number_of_domains_opted_out: Domains that disabled Greylisting

28. Calendar and Contacts Server (CCS) & ActiveSync

For collaboration features, the system collects:

• ccs_present: Whether the CCS plugin is installed
• ccs_users_previous_day: Users who logged into CCS in the last day
• zpush_present: Whether the Z‑Push ActiveSync plugin is installed
• zpush_users_previous_day: Users who accessed ActiveSync in the last day

29. CalDAV/CardDAV Service Data

The cpdavd service provides metrics related to calendar and contact synchronization:

• caldavcarddav_users_previous_day: Unique users who logged in during the last 24 hours
• caldavcarddav_user_agents: Mapping of User‑Agent strings to unique user counts

51. Hostname Configuration Data

The Configuration Analytics system collects several details about the server’s hostname to verify identity consistency and DNS behavior.

• hostname: The current hostname assigned to the server
• hostname_resolves_to_server: Whether the hostname resolves to the server’s primary IP address
• hostname_is_autoissued: Indicates if the hostname was automatically generated

52. Installation Environment Metrics

This section gathers information about the installation and environment of cPanel & WHM, helping track system history and configuration changes.

• cpanel_install_mtime: Timestamp of the initial installation
• dnsonly: Whether the server is running DNSOnly
• ea_libcurl_version: Version of libcurl installed
• easyapache_version: Version of EasyApache in use
• envtype: The environment type of the installation
• cl_edition: CloudLinux edition (if applicable)
• mem_swap: Amount of swap memory available
• mem_total: Total system memory
• server_mainipv4: Primary IPv4 address
• server_install_uuid: Unique installation identifier
• before: Version before the update
• after: Version after the update

53. IPv6 Configuration Data

To understand IPv6 usage and compatibility, the system collects:

• bound_address_count: Number of IPv6 addresses assigned
• accounts_with_jailshell: Accounts using jailshell
• num_a6_records: Number of deprecated A6 DNS records
• has_slaac: Whether SLAAC IPv6 addressing is used
• has_ipv6_address_range: Whether an IPv6 range is configured
• host_is_slaac: Whether the host uses SLAAC
• accounts_with_ipv6: Accounts with IPv6 addresses
• network_interfaces: Network interfaces detected on the server

54. License Information

License-related data helps determine the status of trial and paid licenses.

• company-id: ID of the license owner
• cp-current-license-kind: Current license state (trial, active, inactive, etc.)

55. Locale Configuration

The system tracks custom locales and language usage across accounts.

• custom_locale: Custom locales available on the server
• locale: Accounts using each specific locale

56. Malware Detection Data

Using Imunify, the system collects malware-related statistics:

• infected_files: Number of infected files detected
• infected_dbs: Number of infected databases detected

57. Nameserver Configuration

Nameserver data helps analyze DNS structure and security.

• clustering: Whether DNS clustering is enabled
• secure_zone_count: Number of DNSSEC-enabled zones
• type: DNS server configuration type
• zone_count: Total number of DNS zones

Default Nameservers for Accounts

• NS: Primary nameserver
• NS2: Secondary nameserver
• NS3: Tertiary nameserver
• NS4: Quaternary nameserver

Authoritative Nameserver Data

• dns_authhandler: Authoritative DNS provider for the domain
• authoritative_dns: Whether the server or cluster hosts the authoritative DNS

58. Package Information

The system collects data about packages managed by the rpm.versions system:

• rpm_locations: Locations of modified packages
• url_templates: Template URLs used by the system
• srpm_versions: Source package versions
• file_format.version: File format version
• target_settings.software: Whether package installation succeeded
• install_targets: Installation targets

59. Ruby Passenger Data

• number_of_ruby_apps: Number of Ruby applications installed
• has_modpassenger: Whether Phusion Passenger is installed

60. Search Engine Optimization Plugin Data

The system collects usage and availability data for the SEO plugin:

• addressable-cpanel-users: cPanel users who can access the plugin
• addressable-webmail-users: Webmail users who can access the plugin
• addressable-whm-users: WHM users who can access the plugin
• commerce-available: Availability of commerce integration
• commerce-enabled: Whether commerce integration is enabled
• is-plugin-available: Plugin availability
• is-plugin-usable: Plugin usability
• local-disabled: Whether the plugin is disabled
• local-enabled: Whether the plugin is enabled

61. SSL Certificate Information

SSL data for the cpsrvd service includes:

• not_before: Certificate start date
• is_self_signed: Whether the certificate is self‑signed
• not_after: Certificate expiration date

62. Site Publisher Usage Data

• total: Total number of Site Publisher websites
• system: Domains using root‑provided templates
• cpanel: Domains using cPanel templates
• reseller: Domains using reseller templates
• domains: Domains hosting a Site Publisher website

63. Site Quality Monitoring Data

• activated_users: Users who completed signup
• active_users: Users who started signup
• available_users: Users eligible for signup
• disabled_globally: Whether all feature lists disable the tool
• disabled_in_default_featurelist: Disabled in default feature list
• featurelists_disabled: Number of feature lists disabling it
• featurelists_enabled: Number of feature lists enabling it
• rpm_installed: Whether the feature is installed
• unactivated_users: Users who didn’t complete signup
• users_with_invalid_config: Users with invalid configurations

64. Sitejet Builder Usage Data

• available-sitejet_users-count: Users with access to Sitejet Builder
• sites-published: Total published Sitejet websites
• sites-published-l30d: Sites published in the last 30 days
• domains-published-by-customer: Domains published by each user
• cpanel-customer-id: User UUID
• domains: Domain names and website IDs
• sites-total: Total created websites

65. Social Media Management Plugin Data

• addressable-cpanel-users: cPanel users who can use the plugin
• addressable-webmail-users: Webmail users who can use the plugin
• addressable-whm-users: WHM users who can use the plugin
• commerce-available: Availability of commerce integration
• commerce-enabled: Whether commerce integration is enabled
• is-plugin-available: Plugin availability
• is-plugin-usable: Plugin usability
• local-disabled: Plugin disabled status
• local-enabled: Plugin enabled status

66. System Configuration at Initial Installation

The Configuration Analytics system records key configuration details from the moment cPanel & WHM is first installed. This helps track how the server was originally set up and provides a baseline for future comparisons.

• hostname: The hostname assigned to the server during the initial installation

67. Theme Usage Data

To understand how users interact with the cPanel interface, the system collects theme‑related statistics across all accounts.

• system_branding: Number of accounts using branded themes
• jupiter: Accounts using the Jupiter theme
• paper_lantern: Accounts using the Paper Lantern theme
• default_theme: Default theme assigned to new accounts
• reseller_branding: Reseller‑owned accounts using branded themes
• X3: Accounts using the legacy x3 theme
• X3mail: Accounts using the legacy x3mail theme
• retro_users: Accounts using the Retro interface style

68. Third‑Party Software Tracking

The system also gathers information about third‑party software installed on the server, helping administrators understand which extensions are active.

• Software key value
• Software name

69. Transfer and Restore Tracking

When accounts are transferred or restored, Configuration Analytics captures details about both the source and destination environments.

69.1 Current Server Environment

• env_type: Type of server environment
• license_type: License user limit for the server

69.2 Incoming Transferred or Restored Accounts

• initial_server_env_type: Environment type of the originating server
• initial_server_license_type: License type of the originating server
• transferred_or_restored: Number of transfers or restores for the account
• uuid: Randomly generated unique identifier
• uuid_added_at_account_creation: Whether the UUID existed at account creation or was added later

70. Two‑Factor Authentication (2FA) Metrics

To evaluate security adoption, the system collects:

• is_root_configured: Whether the root user has 2FA enabled
• is_enabled_on_server: Whether 2FA is enabled server‑wide
• total_accounts_with_tfa_configured: Number of accounts using 2FA

71. Update Process Metrics

Information about cPanel & WHM updates helps track performance and identify issues during the update process.

• duration: Duration of the most recent update
• result: Whether the update succeeded
• update_blockers: Any blockers that prevented updates
• used_ea_tarball: Whether the EA tarball was used
• used_fast_install: Whether the fast installation method was used

71.1 Data from cpsources.conf

• LAYER and RSYNC: Legacy mirrors used for updates
• HTTPUPDATE: Mirror used for software installation and updates

71.2 Data from cpupdate.conf

• RPMUP: Frequency of automatic package updates
• CPANEL: Configured release tier
• UPDATES: Frequency of cPanel & WHM updates
• SARULESUP: Frequency of SpamAssassin rule updates
• STAGING_DIR: Directory used for staging updates

72. WordPress Installation Metrics

To understand WordPress adoption across servers, the system collects:

• wp_toolkit_assigned: Accounts with WP Toolkit enabled but without Deluxe
• wp_toolkit_and_deluxe_assigned: Accounts with both WP Toolkit and Deluxe enabled

80. System Configuration at Initial Installation

The Configuration Analytics system records essential configuration details from the moment cPanel & WHM is first installed. This baseline information helps track how the server environment has evolved over time.

• hostname: The hostname assigned to the server during the initial installation

81. Theme Usage and Interface Styling

To understand how users interact with the cPanel interface, the system collects data about theme usage across all accounts.

• system_branding: Number of accounts using branded themes
• jupiter: Accounts using the Jupiter theme
• paper_lantern: Accounts using the Paper Lantern theme
• default_theme: The default theme assigned to new accounts
• reseller_branding: Reseller-owned accounts using branded themes
• X3: Accounts using the legacy x3 theme
• X3mail: Accounts using the legacy x3mail theme
• retro_users: Accounts using the Retro interface style

82. Third-Party Software Tracking

The system also gathers information about third-party extensions installed on the server. This helps administrators understand which external tools are active and how they integrate with the hosting environment.

• Software key value
• Software name

83. Transfer and Restore Environment Tracking

When accounts are transferred or restored, Configuration Analytics captures details about both the source and destination environments to ensure compatibility and traceability.

83.1 Current Server Environment

• env_type: The type of server environment
• license_type: License user limit for the server

83.2 Incoming Transferred or Restored Accounts

• initial_server_env_type: Environment type of the originating server
• initial_server_license_type: License type of the originating server
• transferred_or_restored: Number of transfers or restores for the account
• uuid: Randomly generated unique identifier
• uuid_added_at_account_creation: Whether the UUID existed at account creation or was added later

84. Two-Factor Authentication (2FA) Metrics

To evaluate security adoption across the server, the system collects:

• is_root_configured: Whether the root user has 2FA enabled
• is_enabled_on_server: Whether 2FA is enabled server-wide
• total_accounts_with_tfa_configured: Number of accounts using 2FA

85. Update Process and Configuration

Update-related data helps administrators understand how cPanel & WHM updates are executed and whether any issues occurred during the process.

• duration: Duration of the most recent update
• result: Whether the update succeeded
• update_blockers: Any blockers that prevented updates
• used_ea_tarball: Whether the EA tarball was used
• used_fast_install: Whether the fast installation method was used

85.1 Data from cpsources.conf

• LAYER and RSYNC: Legacy mirrors used for installation and updates
• HTTPUPDATE: Mirror used for software installation and updates

85.2 Data from cpupdate.conf

• RPMUP: Frequency of automatic package updates
• CPANEL: Configured cPanel & WHM release tier
• UPDATES: Frequency of cPanel & WHM updates
• SARULESUP: Frequency of SpamAssassin rule updates
• STAGING_DIR: Directory used for staging updates

86. WordPress Installation Metrics

To analyze WordPress adoption across the server, the system collects:

• wp_toolkit_assigned: Accounts with WP Toolkit enabled but without Deluxe
• wp_toolkit_and_deluxe_assigned: Accounts with both WP Toolkit and Deluxe enabled