cPanel's spam filtering runs on Apache SpamAssassin. It scores each incoming message against hundreds of tests, and what happens next depends on thresholds you control. Understanding the score is the whole thing; every setting on that page is either a threshold or an exception to one.
How the score works
Each test that matches adds or subtracts points. A message from a blocklisted server gains points; one with a valid DKIM signature loses some. The total is the spam score.
The default threshold is 5. Above it, the message is treated as spam.
Lower is stricter. At 3 you catch more spam and start losing legitimate mail. At 8 almost nothing legitimate is caught and a good deal of spam arrives.
Start at the default. Move in steps of one, and only after seeing a pattern in what is getting through or being caught, adjusting on a single annoying message is how people end up at 2 and wondering where their invoices went.
Turning it on
In cPanel, open Spam Filters under Email. Enable Apache SpamAssassin.
Then decide what happens to messages above the threshold, and this is the decision that matters.
Spam Box moves them to a separate folder. Reversible: you can look, and legitimate mail wrongly caught is recoverable.
Auto-Delete discards them at the threshold you set. Nothing to review, nothing to recover.
Do not auto-delete at the default threshold
This is the setting worth being careful about, because its failures are invisible.
The 5 to 10 band is where false positives live: a newsletter you subscribed to, an invoice from a supplier whose mail server has a poor reputation, a message with an attachment that pattern-matched something. Deleting at 5 discards those with no bounce, no record and no way to know.
The sender believes the message was delivered. You believe nothing was sent. That combination causes real problems and is impossible to diagnose afterwards, because there is nothing left to look at.
If you use auto-delete at all, set it around 10 and leave Spam Box handling everything below. Reviewing a spam folder occasionally costs a minute; the alternative costs an invoice.
Whitelist and blacklist
Whitelist adds a negative score, so listed senders effectively always arrive. Use it for anyone whose mail you cannot afford to miss: your accountant, key clients, your payment processor.
Do not whitelist your own domain. Spam frequently forges the recipient's own address as the sender, and whitelisting your domain gives that forged mail a free pass: a genuinely counterproductive setting.
Blacklist adds a positive score. Useful for a persistent nuisance sender, and largely pointless against spam generally, since senders change addresses constantly.
Both accept whole domains, which is usually more useful than individual addresses.
What filtering cannot fix
Spam filtering handles incoming mail. It does nothing about your own mail being treated as spam by other people; that is authentication, and it is a separate job.
If your messages land in other people's spam folders, SPF, DKIM and DMARC are what you need. Understanding SPF, DKIM and DMARC explains publishing them.
Equally, a full mailbox rejects mail before filtering is involved at all. If mail simply stopped arriving rather than arriving in the wrong folder, check quota first. The email troubleshooting guide goes into the order.
Filters, which are not spam filtering
cPanel also has Email Filters, a separate feature for routing mail by rule, move messages containing a phrase to a folder, forward mail from an address, discard mail to a retired alias.
These run regardless of spam score and are a common cause of the confusing case where mail is definitely being delivered and definitely not appearing. A rule created two years ago and forgotten is quietly discarding matching mail.
When mail vanishes without a bounce, check filters at both account and mailbox level before anything else.
Reviewing the spam folder
Look in it weekly for the first few weeks after enabling filtering. You are checking for legitimate mail being caught, which tells you whether the threshold suits your mail instead of the average.
Two patterns are worth acting on. The same legitimate sender caught repeatedly should be whitelisted. And obvious spam consistently getting through means the threshold is too high for you.
Set the spam folder to clear itself after 30 days or so. Left alone it grows without limit, and on a plan with a disk quota it eventually causes the failure that looks like everything breaking at once.
To act on the spam score rather than trying to identify spam by keyword, How to Create Email Filters in cPanel explains writing the rule.
Comment spam is a separate problem from mail spam, and two settings remove most of it. There is more in How to Stop Comment Spam on WordPress.
If the volume seems disproportionate to your actual correspondence, one setting is usually responsible. How to Set Up a Catch-All Address and When Not To goes into it.
One server-side measure stops a large share of spam without inspecting content at all, at the cost of delaying first messages. Greylisting in WHM: What It Does and When to Turn It Off explains the trade.