Hello, @andyparr1

I will recommend you to secure the server at level same as when applying for PCI compliance. This includes to get rid of all of the old TLS supported versions, disable FTP and insecure mail ports, also disable any port which is not needed and leave just those you actually use (22, 80, 443 and etc). You can also update all the security ciphers for Apache and the rest of the cPanel services as well.

With cPanel you also have the option to use the Host Access Control meaning that you can close every port and make it available only for whitelisted IPs. This is something which is really handy as you can allow only your IP addresses to connect to the server.

Regards,
Alex

Hello, all

A little update on this question.

I’ve recently posted a mini tutorial related with PCI Compliance scan where the outdated TLS versions had to be disabled in order the user to pass the scan. You can check it here:

https://www.digitalocean.com/community/questions/disable-old-tls-versions-1-0-1-1-for-apache-nginx-on-ubuntu-18-04-or-centos-7

Hope this helps!
Regards,
Alex