Cron jobs in cPanel: scheduling a script safely

A cron job is a command the server runs for you on a schedule: every night, every hour, every fifteen minutes. It is how a site refreshes a data feed, sends queued email, clears old files or takes a backup without anyone pressing a button. cPanel gives each account its own schedule.

Adding a job

1. In cPanel, open Cron Jobs (in the Advanced section).
2. Pick a schedule from Common Settings, or fill in the five time fields yourself.
3. Enter the command and press Add New Cron Job.

The five fields are minute, hour, day of month, month and day of week. An asterisk means "every". A few examples:

*/15 * * * *    every 15 minutes
0 * * * *       every hour, on the hour
30 3 * * *      every day at 3:30 in the morning
0 6 * * 1       every Monday at 6:00

Times are in the server's time zone, which may not be yours. The Cron Jobs page shows examples you can compare against the clock.

The command line

To run a PHP script, give the full path to PHP and the full path to the script:

/usr/local/bin/php /home/youraccount/jobs/refresh.php

Full paths matter because cron does not start in your site's folder and knows nothing about your usual settings. If the script itself opens other files, use full paths inside it too, or have it change to its own folder first. Hosts differ in where PHP lives and which version that path runs; if the script needs a particular version, ask your host for the path to it.

Where the output goes

Anything the script prints is emailed to the address at the top of the Cron Jobs page, every time the job runs. That is useful while testing and a flood afterwards. Once the job works, discard routine output by ending the command with:

>/dev/null 2>&1

Have the script write its own short log file instead, including the time and whether it succeeded, so there is something to read when it stops working.

Mistakes that cause trouble on shared hosting

• Running too often. A job every minute is rarely needed and many hosts forbid it. Every 15 minutes is a common minimum; check your host's rules before going lower.
• Overlapping runs. If a job takes longer than its interval, copies pile up until the account hits its limits. Wrap the command so a second copy refuses to start while the first is running:

  flock -n /home/youraccount/tmp/refresh.lock /usr/local/bin/php /home/youraccount/jobs/refresh.php

• Heavy jobs at busy times. Schedule backups and large imports for the early morning.
• Passwords in the command. Commands can appear in emails and logs. Keep credentials in a file only your account can read, and have the script load them.

Keep job scripts out of the public folder

A script meant for cron should not be something a stranger can trigger by visiting an address. Store it outside public_html, for example in /home/youraccount/jobs/. If it must live in the web folder, make it refuse to run from a browser by putting this at the top:

<?php if (php_sapi_name() !== 'cli') { exit; }

WordPress: replace the built-in scheduler

WordPress runs its scheduled tasks when visitors load pages, which means tasks are late on a quiet site and add work to every request on a busy one. Turn that off by adding this line to wp-config.php:

define('DISABLE_WP_CRON', true);

Then add a cron job every 15 minutes that runs the task file directly:

/usr/local/bin/php /home/youraccount/public_html/wp-cron.php >/dev/null 2>&1

Test before you trust it

Run the exact command once in cPanel's Terminal and read what it prints. Then set the schedule to every few minutes, watch the log through two or three runs, and only then move it to its real schedule and silence the output.

Common questions

How do I know a job actually ran?

Have the script append a line with the date and result to a log file, and read that. While testing, leave the email output on. Hosts also keep a system cron log, but on shared hosting you usually cannot read it yourself.

Can I fetch a web address instead of running a script?

Yes, with curl -s https://yourdomain.com/task.php. It is simple, but the task then runs through the web server with its time limits, and the address can be called by anyone who finds it. Protect it with a long secret value in the address, and prefer the command-line form for anything slow.

What happens to jobs during daylight-saving changes?

Jobs follow the server's clock. On the night the clocks change, a job scheduled inside the skipped or repeated hour can be missed or run twice. Schedule important jobs outside the hours between 1 and 3 in the morning, or make them safe to run twice.