Panellicense

Set up WHM reseller accounts with the right ACLs

Reseller accounts are how you sublease a cPanel server. Set the wrong ACLs and the reseller can suspend your accounts or restart Apache — here's the safe baseline.

8 min readUpdated 2026-05-16whm · reseller · acl · cpanel
schema: HowToschema: FAQPageschema: BreadcrumbList

A WHM reseller account is the closest thing cPanel has to a multi-tenant primitive. The reseller gets their own WHM login, creates cPanel accounts up to their package limits, and manages DNS, SSL, and email for those accounts — without ever seeing the rest of the server. Get the ACLs right and you have a sublease-able hosting product. Get them wrong and the reseller can suspend your customers' accounts or restart Apache.

This guide is the safe baseline for a paid reseller: which ACLs to grant, how to cap their footprint with packages, when to assign a dedicated IP, and the four mistakes that turn a reseller programme into a support fire.

What a reseller actually owns

A reseller is a cPanel account with the "Reseller" flag set. They can:

  • Create, modify, suspend, and terminate cPanel accounts up to their package's account cap
  • Allocate disk and bandwidth quota across those accounts, within their own pool
  • Manage DNS zones, SSL certificates, and email routing for accounts they own
  • Set a custom WHM theme, contact email, and welcome message

They cannot — by default — see other resellers' accounts, restart services, or change server-wide settings. The "by default" is doing a lot of work in that sentence: the ACL list contains several toggles that grant exactly those abilities, and the labels don't always make the blast radius obvious.

Create the parent reseller account

Create a clean cPanel account first, then promote it. Don't promote an existing customer — the reseller account owns a pool of accounts, and moving existing accounts into a reseller pool after the fact requires whmapi1 setresellerlimits plus manual ownership transfer, which is painful enough that you want a fresh start.

In WHM → Account Functions → Create a New Account:

  • Use a reseller-only domain like reseller.yourcompany.net as the primary domain
  • Assign a "Reseller" package with the total disk and bandwidth quotas the reseller is allowed to consume across all their customers
  • Tick Reseller Settings → Make the account a reseller

Then go to Resellers → Reseller Center, select the account, and open Edit Privileges & Nameservers.

ACLs to grant — and what to keep root-only

The ACL list is long and the WHM UI groups it confusingly. The mental model that works: any ACL that affects only the reseller's own accounts is generally safe; any ACL that touches the server or other resellers is not.

Safe defaults

Tick these for a standard paid reseller:

  • Create Accounts, Modify Accounts, Suspend Accounts, Terminate Accounts
  • Edit DNS Zones, Edit MX Entries, Park Domains, Add or Remove Subdomains
  • Manage SSL Hosts, Install an SSL Certificate
  • View Resold Accounts Bandwidth Usage, List Accounts
  • Allow Creation of Accounts with Shell Access — only if SSH is part of the plan; otherwise leave off

ACLs that hand over your server

Never grant these to a paid reseller:

  • All Features (sometimes labelled "Super Privileges") — root-equivalent. The reseller can create accounts on any package, edit any user, and bypass their own quotas.
  • Restart Services, Reboot Server, Shutdown Server — self-explanatory.
  • Allow Creation of Accounts with All Features — lets the reseller create child accounts that themselves have full WHM access.
  • Modify Account Limits Beyond Their Own — the reseller can exceed the package quotas you gave them.
  • View Server Information, View Server Status — leaks load average, memory, and process info for the whole server.
  • Manage API Tokens combined with anything broad — a token authenticated against an over-privileged reseller is root-equivalent over curl.

Cap the reseller with packages

Reseller package limits are separate from the cPanel packages the reseller offers their own customers. In Packages → Add a Package, create the reseller's parent package with:

  • A total disk quota that caps the sum of all their customers' usage
  • A total bandwidth cap measured monthly
  • An account limit — the maximum cPanel accounts they can create
  • Per-account caps: MAXSUB, MAXPOP, MAXFTP, MAXLST if you're charging by account type

Then create the customer-facing packages the reseller will sell (Starter, Pro, etc.) and assign them via Resellers → Reseller Center → Package Privileges. The reseller can only create new accounts using packages you've explicitly assigned.

If you want the reseller to define their own packages, grant the Add Packages ACL and the Edit Packages ACL — but also set hard upper limits under Reseller Center → Edit Reseller's Package Limits, so they can't define a 1 TB plan.

Shared IP vs dedicated — and when to switch

By default, all reseller accounts use the server's shared IP. This is fine for almost everything: SNI HTTPS works in every browser shipped this decade, and Let's Encrypt issues SAN certificates without issue. Allocate a dedicated IP only when:

  • The reseller runs outbound mail at volume and needs IP reputation they control
  • They're large enough that sharing IP reputation with other customers is a real deliverability risk
  • A specific app (legacy SSL clients, some payment gateways with IP allowlists) requires it

To allocate: Resellers → Manage Reseller's Shared IP and SSL Certificate, untick "Share IP", and assign one from your server's IP pool. A dedicated IPv4 costs you an address from your provider's allocation — bake the cost into the reseller's monthly bill.

Branding: nameservers and custom hostname

A reseller almost always wants their customers to see ns1.theirbrand.com and ns2.theirbrand.com in WHOIS, not yours. This is two changes on your side and one on theirs.

On your server, add A records for the reseller's nameservers pointing to two of your IPs:

whmapi1 adddns domain=theirbrand.com class=IN \
  ip=203.0.113.10 ns=ns1.theirbrand.com,ns2.theirbrand.com

Then under Resellers → Edit Reseller Nameservers and Privileges, set those nameservers as the reseller's defaults. The "Create Account" UI in their WHM will pre-fill them.

On the reseller's side, they need to register glue records at the registrar for theirbrand.com, pointing ns1 and ns2 to the same two IPs. Without glue, the nameservers resolve via your DNS, which defeats the branding.

If you're running multiple cPanel servers, push the zones via a DNS-Only cluster so the reseller's nameservers stay in sync across the fleet.

Common mistakes

  1. Granting All Features instead of reading the ACL list. It hands over the server. Tick individually — the list is long but it's a one-time setup.
  2. No parent package quota. Without a cap on the reseller's total disk and account count, one bad reseller fills the box by creating 500 accounts with default quotas.
  3. Selling resellers without resource isolation. A reseller's customer running a runaway WordPress plugin takes out the entire shared server unless CloudLinux LVE is tuned per account. For any serious reseller programme, CloudLinux isn't optional.
  4. Forgetting glue records. The reseller's nameservers won't resolve until glue is registered at the registrar — a customer-side step, but worth scripting into your reseller onboarding email.

FAQ

What ACLs should I give a cPanel reseller?+
Grant only the per-account ACLs: Create/Modify/Suspend/Terminate Accounts, Edit DNS Zones, Manage SSL, Park Domains, and List Accounts. Never grant 'All Features', 'Restart Services', or 'Modify Account Limits Beyond Their Own' — these touch server-wide state and are effectively root-equivalent.
Can a cPanel reseller see other accounts on the server?+
No, not with default ACLs. A reseller can only see accounts they own. They become able to see other resellers' accounts only if granted 'List Accounts' globally or 'All Features', both of which should stay off.
How many cPanel accounts can a WHM reseller create?+
Whatever you cap them at in the reseller's parent package under 'Account Limit'. The default is unlimited, which is rarely what you want — set it explicitly when you create the package, even if the number is high.
Do cPanel resellers need their own dedicated IP address?+
Almost never. SNI HTTPS works in every modern browser and Let's Encrypt issues SAN certificates on the shared IP. Give a reseller a dedicated IP only when they have a specific mail reputation or payment-gateway requirement that demands it.
Can I sell reseller hosting without CloudLinux?+
Technically yes, but you shouldn't. Without LVE, one reseller's customer running a bad plugin can saturate CPU or memory and take down every other reseller on the server. CloudLinux is the only mainstream way to isolate accounts on a shared cPanel box.
How do I revoke reseller privileges in WHM?+
Go to Resellers → Reseller Center, select the account, and click 'Unmake Reseller'. The cPanel account stays intact but loses WHM access. The accounts they previously created remain owned by them — to reassign ownership, use 'Modify Account' on each child account.

Next steps

Related articles

All tutorials & how-tos →
how to
Set up JetBackup 5 deduplication backups to cut storage cost
JetBackup 5.4 added a deduplication backup structure that fingerprints data in chunks and stores each unique chunk once — here's how it works, where it pays off, and how to turn it on.
6 min read
how to
Plesk 360 setup guide for centralized licenses and monitoring
Plesk 360 is the SaaS control plane for everyone running more than one Plesk box — license management, uptime monitoring, and SSO into every panel from one dashboard.
7 min read
how to
Use the Plesk REST API with reseller and customer accounts
Plesk Obsidian 18.0.79 opens the REST API to reseller and customer accounts and adds file, log, and impersonation endpoints — how to authenticate and use them.
7 min read
Switch in an afternoon

Switch from your current reseller — free.

We migrate active cPanel, Plesk, LiteSpeed and CloudLinux licenses from any reseller. We prorate the first month so you never pay twice, and your customers see zero downtime during the swap.