How to install Softaculous on cPanel and harden the defaults

Softaculous Premium installs WordPress, Joomla, and roughly 450 other scripts in one click, which on a shared-hosting box with a few hundred customer accounts is the difference between "I launched my blog" and "I opened a support ticket". This guide is the 30-minute install: auto-installer, license activation, and the four defaults worth changing before a customer touches the panel.

If you already have Softaculous running and just need to clear a license banner, jump to troubleshooting. The install is the easy part — most operators get bitten by the post-install defaults.

Before you start

• A working cPanel/WHM server. If you don't have one yet, start with installing cPanel on a fresh VPS.
• Root SSH access.
• A Softaculous Premium license — activate one in under a minute. Like cPanel, the license is pinned to the server's public IPv4.

You do not need to stop Apache, LiteSpeed, or any cPanel service for the install. It's non-disruptive — customers can keep using their accounts while it runs.

Step 1 — Run the auto-installer

The installer is a single shell script and finishes in about three minutes:

wget -N https://files.softaculous.com/install.sh
chmod 755 install.sh
./install.sh

The script detects cPanel, places binaries under /var/softaculous, registers the WHM plugin, and injects the cPanel-side plugin into every existing account. No reboot, no service restart.

When it's done, log in to WHM and look for Software → Softaculous – Instant Installs in the left sidebar. If the menu item is there, the install worked.

Step 2 — Activate the license

Softaculous verifies licenses against licenses.softaculous.com over HTTPS — TCP 443. Outbound 443 is open on essentially every hosting network, so failures here are almost always an IP mismatch rather than a firewall problem.

Check the IP the license server sees:

curl -s https://www.softaculous.com/ip

If that matches what's on file with your reseller, the first WHM-side page load activates the license automatically. If it doesn't, update the IP in your reseller portal — for licenses bought through us, the change takes about a minute end-to-end. See contact if you need to move a license between IPs.

To force a refresh from the CLI instead of waiting for the next cron tick (every four hours by default):

/var/softaculous/cli.php --update

A successful run prints Update Successful and the refreshed expiry date.

Step 3 — Trim the script list

Softaculous ships with roughly 450 scripts enabled by default. Most of them are abandonware, fork-of-a-fork CMSs, or hyper-niche tools that confuse customers and inflate your support load. Turn off everything you don't want shown.

In WHM go to Softaculous – Instant Installs → Settings → Disabled Scripts.

A shortlist that covers 95% of real shared-hosting demand:

• WordPress — the only one most customers ever pick
• WooCommerce — technically a plugin, but listed as its own entry
• Joomla 4 and Joomla 5 — legacy but real demand
• Drupal 10 — small, vocal user base
• PrestaShop and OpenCart — if you sell e-commerce hosting
• phpBB — if your customer base skews technical
• Moodle — if you target education

Disable everything else. Fewer options means fewer "I installed X and the project was abandoned in 2014" tickets, and you remove a long tail of scripts that Softaculous itself doesn't always patch promptly.

Step 4 — Set a sane auto-update policy

This is the setting that costs operators the most pain. Done wrong, you ship one Tuesday- morning support flood every time WordPress pushes a release.

WHM → Softaculous – Instant Installs → Settings → Auto Upgrade.

The honest tradeoff: auto-upgrading plugins server-wide swaps one risk (unpatched vulnerabilities) for another (a regression silently breaking the site overnight). For shared hosting the better answer is conservative auto-upgrade plus a server-level WAF — ImunifyAV or ModSecurity with the OWASP Core Rule Set — handling the security half. If you're running CloudLinux already, see CloudLinux LVE tuning without angry customers for the resource-isolation companion piece.

Step 5 — Enable backup-before-upgrade

Even with conservative auto-upgrade settings, the occasional WordPress minor will collide with a customer's custom code. Pre-upgrade backups are the safety net.

WHM → Softaculous – Instant Installs → Settings → Backup.

• Backup Location — a separate disk if you have one; otherwise /home/softaculous_backups. Don't put it under any cpuser home — it counts against their quota.
• Backup Rotation — keep 3. Enough to roll back the last few attempts without filling the disk.
• Backup Before Auto Upgrade — On.
• Backup Before Manual Upgrade — On.

If you're already running JetBackup or Acronis at the server level, the Softaculous backups are redundant from a "is the data safe" perspective. Keep them anyway — Softaculous backups restore in seconds because they're application-aware, where a JetBackup restore puts back the whole cPanel account.

Step 6 — Optional white-labelling

Softaculous lets you remove their branding from the customer-facing UI under Settings → Themes & Branding. For most resellers this isn't worth the time. Agency hosts who sell "their" panel often do want it — half an hour of CSS tweaks gets you a clean, unbranded installer that doesn't broadcast which vendor sits behind it.

The WHM-side "Softaculous" branding is harder to remove and rarely worth the effort, since the only people who see it are your own admins.

Troubleshooting

"License is invalid for this IP" — the server's public IP doesn't match the IP on the license. Run curl -s https://www.softaculous.com/ip, compare to the license, and update the IP in your reseller portal. This is the same IP-pinning pattern as a cPanel license invalid error — Softaculous and cPanel both license per public IPv4.

"Could not connect to license server" — outbound 443 is blocked or DNS is broken. Test with curl -v https://licenses.softaculous.com/. CSF and similar host firewalls don't block 443 by default, so look upstream — cloud security groups, corporate firewalls, broken resolvers.

WHM plugin not appearing — rebuild the plugin cache:

/usr/local/cpanel/scripts/restartsrv_cpsrvd

The plugin then loads on the next WHM page refresh. If that doesn't fix it, re-run the installer — it's idempotent.

Backups failing silently — almost always disk space. Softaculous logs to /var/softaculous/softaculous.log; the words disk full or No space left on device will be in there if that's the cause.

FAQ

Next steps

• How prorated license billing actually works — what you pay in the first partial month after activation.
• How to fix cPanel license invalid errors — the IP-pinning story applies identically to Softaculous, so the same decision tree works.
• Volume and reseller pricing — the per-license cost drops on Softaculous Premium once you cross the multi-server tiers.