1. Introduction
When you suspend an account in cPanel & WHM, the system performs a series of security and access‑limiting actions. These actions stop the account’s activity, restrict access, and prevent further use of server resources.
Note: Suspension is different from bandwidth limiting.
2. Suspension Flags
The system adds the following flags to /var/cpanel/users/user:
SUSPENDED=1SUSPENDTIME=epochdate
This updates WHM interfaces to show the account as suspended.
3. Reseller Access Lock
By default, a suspended reseller who owns their own account can still access it.
You can change this behavior in:
WHM » Server Configuration » Tweak Settings
Set Accounts that can access a cPanel user account to cPanel User Only.
Warning: This prevents the root user from accessing any cPanel account.
Alternatively, when suspending an account, enable Prevent resellers from unsuspending. This creates:
/var/cpanel/suspended/user.lock4. Stops All User Processes
The system terminates all processes owned by the user. Effects include:
- Forced logout of active sessions
- Stopping all cron jobs
5. Locks Mailing Lists
The system moves Mailman list files into suspended.lists.
Result: Mailing lists stop functioning.
6. Locks Web Disk
The system adds *LOCKED* to Web Disk password files:
/home/homedir/etc/webdav/shadowResult: Web Disk access is disabled.
7. Locks Email Passwords
The system adds *LOCKED* to email password files:
/home/homedir/etc/domain/shadowResult: Email users cannot download mail, but incoming mail is still delivered.
8. Incoming and Outgoing Email
- Users cannot send email.
- Messages in the outbound queue fail.
8.1 Email Delivery Behavior
You can configure how Exim handles incoming mail for suspended accounts in:
WHM » Service Configuration » Exim Configuration Manager
| Setting | Description |
|---|---|
| Deliver messages normally | Processes mail normally (risky) |
| Accept and discard messages | Accepts then deletes mail |
| Reject messages at SMTP time | Rejects mail with a permanent error |
| Accept and queue messages | Queues mail until unsuspended (default) |
9. Apache Configuration Updates
The system creates the following include file:
/etc/apache2/conf.d/includes/account_suspensions.confThis file contains a RedirectMatch rule that redirects all website traffic to the suspended account template.
You can edit the suspended page in:
WHM » Account Functions » Web Template Editor
10. Locks the Shadow Password
The system runs:
passwd -l userEffects:
- User cannot log in to cPanel
- Database users cannot authenticate
- Password cannot be changed
11. FTP Directory Permission Changes
The system sets public_ftp permissions to 0000.
It also creates:
/etc/proftpd/user.suspendedFTP passwords are locked by prepending !!.
Result: FTP users cannot log in.
12. MySQL Password Changes
The system changes all MySQL user passwords.
Result: Database users cannot access their databases.
Note: Amazon RDS remote databases are not affected.
Conclusion
Suspending an account in cPanel & WHM triggers a comprehensive set of restrictions affecting email, FTP, databases, websites, and user access. These measures ensure security and prevent misuse of server resources during suspension.