IIf you are concerned that an active WHM session can remain accessible simply by refreshing a logged-in browser window, you are not alone. Persistent authenticated sessions can create a serious security risk if an attacker manages to steal the browser’s session cookie.
Session-cookie theft is particularly dangerous because it can allow an attacker to impersonate an authenticated user without entering their password or completing two-factor authentication. Google has confirmed that stolen authentication cookies can bypass login-time security checks and continue working even after the original malware has been removed.
A well-known example occurred in March 2023, when an employee at Linus Media Group opened a malicious file disguised as a sponsorship document. The attackers stole browser session data, gained control of the Linus Tech Tips and associated YouTube channels, and used them to promote cryptocurrency scams.
Until cPanel introduces stronger controls for managing or invalidating active WHM sessions, there is a practical workaround you can implement to reduce the risk. Read on to learn how it works.
There is a work around to make the sessions expire and it involves setting up a very simple cron job to run a command via CLI.
Step 1
Head over to your terminal in WHM, note you will need root privileges to set this up, this use case is mostly aimed at dedicated servers, however most cPanel shared hosting does come with its own version of WHM so check with your hosting provider for more.
Step 2
Run the command crontab -e and this will display a list of Cron Jobs currently setup on the server.
Step 3
On a new line add a new cron job with a time that you would like to expire sessions, below is an example of a cron job to boot sessions at 11am daily, you can pick anytime you like or multiple times per day.
00 11 * * * rm -fv /var/cpanel/sessions/raw/*
If you don’t want to setup a cron and just want to be able to boot sessions whenever you like, you can head to terminal in WHM and run the following command rm -fv /var/cpanel/sessions/raw/* this will kick all current sessions. Along with kicking the sessions it will also tell you what username of the sessions were kicked, be in root sessions or cPanel user sessions.
