cPanel Tab

Use the cPanel member tab to manage a WHM server in a ServersCTL hosting pool. It brings server health, WHM accounts, account transfers, recovery actions, and cPanel service controls into one workspace for the selected server.

The cPanel tab is for WHM/cPanel servers. OpenLiteSpeed-only servers use the OpenLiteSpeed tab instead.

Free and Pro

Community is enough for visibility and manual account copy workflows. Pro is for production hosting operations: account management, automated DNS cutover, recovery, live transfers, backups, and service control.

Requirements

For the full cPanel workspace:

• The server must be enrolled as a pool member.
• The balctl agent must be checking in.
• cPanel/WHM must be detected.
• WHM must be linked for account and migration tools.
• A second compatible cPanel member is needed for transfer workflows.
• Saved DNS keys are needed for automatic DNS updates.

If the tab is visible but actions are unavailable, check the member Status tab, WHM link state, and plan level.

Subtabs

Some subtabs only appear after the server is detected as cPanel and WHM is linked for the pool.

Overview subtab

Use Overview as the first stop for a cPanel member.

The Overview subtab shows:

• The cPanel protection and recovery topology.
• Whether accounts are protected or have standby coverage.
• Service stack badges.
• Quick links to WHM and Webmail when available.
• Quick actions such as account creation or backup where available.
• WHM audit information when the server is linked.

Use this subtab to understand whether the selected server is acting as the live source, standby, or an unprotected cPanel host.

Operations subtab

Use Operations for server-level cPanel health and maintenance.

The Operations subtab shows:

• cPanel health and license state.
• Web, mail, cPanel, database, and related service state.
• Listener and network information.
• Disk usage and server metrics.
• WHM API status and DNS drift information.
• cPanel and mail log tails.

Common Pro actions:

Check Cron & Jobs after starting any action.

Accounts subtab

Use Accounts to work with WHM accounts on the selected server.

The Accounts subtab shows:

• All WHM accounts returned for the member.
• Domain, username, IP, plan, email, disk usage, and status where available.
• Filters for all, active, and suspended accounts.
• Account details in a drawer or modal.
• Protection and DNS hints when configured.

Community users can view the full list and inspect details. Pro users can also run account actions.

Pro account actions:

Termination is destructive. The confirmation asks you to type the domain so accidental deletion is harder.

Agent Transfer subtab

Use Agent Transfer is the member cPanel inner tab for one-shot cPanel → cPanel account copies between enrolled pool members. Agents package the source account, move the archive over a direct route or through user storage, restore on the destination with restorepkg, and optionally swing the DNS after the copy succeeds.

Direct Transfer security model

Direct Transfer is not an open file receiver and it is not general-purpose SSH access. The API acts as the control plane for a one-offsingle copy operation:

The authenticated operator starts a transfer. The dashboard calls the Worker with the selected source member, destination member, cPanel username, route mode, and DNS handling choice. The Worker checks plan access, pool ownership, WHM/cPanel compatibility, account copystate, agent versions, destination disk, and route availability before creating the run. API creates a one-use session. The Worker mints a random session ID, records the exact source node, destination node, account username/domain, expected byte count, destination address, source IP filter, status, and expiry. Session APIs reject unknown, expired, terminal, wrong-role, or wrong-status sessions. Only enrolled agents can advance it. Source and destination agents call back using their normal enrolled heartbeat credentials. The Worker verifies that the calling node is the recorded source or destination for that session before accepting prepare, public-key registration, progress, transfer-complete, or restore-complete updates. The source generates an ephemeral SSH key. The source agent creates a session-scoped keypair for this transfer. The private key stays on the source server. The public key is sent to anotherthe compatibleWorker, cPanelwhich serverqueues inan authorised job for the samedestination account.agent. Destination installs a restricted receiver key. The destination agent writes the public key to root authorized_keys with a forced command for chunk receive only, plus from=<source-ip>, no-port-forwarding, no-X11-forwarding, no-agent-forwarding, no-pty, and no-user-rc. A matching session.json must exist before any chunk is accepted. Chunks are individually checked. The source agent streams fixed-size chunks over SSH. The forced receiver accepts only sessionId, chunk index, and chunk SHA-256, reads the chunk from stdin, verifies the chunk hash, and writes it under that session's temporary receive directory. Archive integrity is checked before restore. After transfer, the destination agent assembles the archive and verifies the final SHA-256 recorded on the session/run before calling restorepkg. Session cleanup is automatic. On success, failure, expiry, or revoke, the destination removes the matching authorized_keys line and deletes the temporary session directory. The Worker will also queue cpanel_account_sync_revoke if the run fails before normal cleanup.

The session lifetime is time-limited. It has a 30-minute minimum and scales with package size using a conservative transfer-rate estimate, so a large package has enough time to complete without leaving a permanent receiver open.

This is the direct account transfer workspace. It is separate from scheduled Protection and separate from the WHM live transfer wizard.

To transfer an account:

1. Open Agent Transfer on the source cPanel member.
2. Choose or drag an active account.
3. Choose a compatible destination cPanel member.
4. Review the route preflight.
5. Choose DNS handling.
6. Start the transfer.
7. Watch the transfer spotlight until it completes.

DNS handling:

The direct route is preferred. If direct transfer cannot work and user storage is available, the transfer can use storage as the fallback route. If storage is required but unavailable, add storage or use another transfer method.

After a successful direct transfer, the temporary transfer access is cleaned up. The account archive may remain on the destination server for the user to remove when they are finished with it.

Migrate & Recovery subtab

Use Migrate & Recovery for live WHM transfer sessions between cPanel members.

This is a Pro workflow for native WHM transfers. It shows outgoing and incoming sessions for the selected server, including route, direction, status, DNS cutover state, and last update time.

To start a live WHM transfer:

1. Open Migrate & Recovery.
2. Choose Start transfer.
3. Pick the account.
4. Pick the target cPanel server.
5. Review preflight checks.
6. Decide whether DNS cutover should run.
7. Confirm and monitor the session.

Use the refresh button to update transfer sessions. If a completed transfer had DNS cutover enabled but DNS failed, use the retry option after fixing the DNS key or zone issue.

Agent Transfer vs Migrate & Recovery vs Protection

Use Agent Transfer when you want a direct copy now. Use Protection when you want ongoing standby coverage. Use Migrate & Recovery when you specifically want the WHM transfer workflow.

WHM Binding

Full WHM API when member matches pool host. Run WHM link check recipe after DNS connect.