Both live on the same account row in WHM, and one of them cannot be undone. It is worth being precise about which is which.
What suspension actually does
Nothing is deleted. The home directory, databases and mailboxes stay exactly where they are.
What changes is access. The website is replaced by a suspended-account page. The customer cannot log into cPanel. Outgoing mail from the account stops, and incoming mail is refused rather than queued indefinitely.
Unsuspending restores all of it in a second, with nothing lost. That is the whole point of the mechanism: it is a pause, and it is the correct response to almost every situation where termination feels urgent.
Suspension reasons are for you, not the customer
WHM lets you record a reason. Use it, in plain language, with a date, "non-payment, invoice 4412, suspended 14 Aug" beats "overdue".
Six weeks later, that note is the entire memory of why an account is off. It appears in the account list, so the next person to look at the server can answer the question without asking you.
Non-payment suspension has a sequence
Suspend, then wait, then terminate: with real time between the steps.
Suspension is what actually gets attention. A customer who ignored four invoices notices within minutes of the site going down, and a large share of overdue accounts are settled in the hour after suspension rather than after any email.
Terminating on the same day removes the possibility of that outcome, and replaces a recoverable situation with a refund argument and a lost customer.
What termination removes
The home directory and everything in it. Every database belonging to the account. Every mailbox, including the mail inside it. The DNS zone for the domain.
There is no undo. The only route back is a backup, and only if one already exists and covers the right date.
Three checks before terminating
A backup exists, and you have restored one. A backup that has never been restored is a belief, not a backup. Restoring a cPanel account from backup explains proving it, and the reseller backup strategy deals with retention, which is the part that decides whether a backup still exists when someone asks in November for an account removed in September.
The account has been suspended long enough. If nobody has contacted you during a suspension, the risk of termination is low. If you never suspended it, you have no evidence either way.
The domain is not still pointing here. Terminating removes the DNS zone. If the domain still resolves to this server, the result is not a clean disappearance. It is a domain that resolves to a server with nothing to serve, which looks like an outage rather than a closed account.
Keep a copy on the way out
The habit worth having: generate a full account backup, download it, and only then terminate.
It costs a few minutes and it converts every future version of "can you get my site back" from an impossible conversation into a file transfer. Customers who left badly are the ones most likely to ask.
Suspension for abuse is a different call
Non-payment can wait a day. A compromised account sending mail, or one consuming the whole server's processing, cannot. The harm is being done to everyone else on the machine while you deliberate.
Suspend immediately, then investigate. Suspension is reversible, so acting fast on a suspicion costs you an apology at worst. Leaving a compromised account running while you gather certainty costs your other customers their mail reputation.
The WHM security centre goes into what a reseller can see and change when that happens.
What suspension looks like from outside
Worth knowing precisely, because customers ask and because it affects things beyond the website.
Visitors get a suspended-account page rather than an error, which is clear and also public: anyone can see the account is suspended, including the customer's own clients.
Incoming mail is refused rather than queued, so senders receive a bounce and the messages are genuinely lost rather than delayed. That is the part customers do not anticipate and it is worth stating when you suspend.
Scheduled tasks stop, which means anything the account was doing on a timer (backups, imports, notifications) simply does not happen for the duration.
DNS continues to resolve, since the zone is untouched. The domain still points here and finds a suspended account, which is why a suspension does not look like an outage to anyone checking whether the domain works.
Suspending one thing rather than everything
Full suspension is not always proportionate, and finer options exist.
A compromised mailbox can be disabled or have its password changed while the rest of the account continues serving, which contains the damage without taking a business offline.
An account sending spam can have its outbound mail stopped while the website stays up. That addresses the harm to other customers, which is the urgent part, without the collateral of a full suspension.
Choosing the narrower action when it is sufficient is what distinguishes a proportionate response from a blunt one. What to do when an email account is compromised sets out that specific case.
Restoring a terminated account
If the decision turns out to be wrong, or a customer returns, restoration is possible only from a backup and only within its retention.
ls -la /backup/*/accounts/ | grep username /scripts/restorepkg username
Two things determine whether that works: whether a backup covering the right date still exists, and whether the username is still free. A terminated account's name can be reused, and reusing it makes restoration considerably harder.
Which is the practical argument for keeping the username reserved for a period after termination rather than releasing it immediately.
Records to keep after termination
The account is gone and some information about it should not be.
What was terminated, when, why, and on whose instruction. The final backup and where it is stored. The date after which that backup will be deleted.
All three are asked for later, sometimes by the former customer and occasionally in a dispute. Reconstructing them from memory is not possible, and the absence of a record is itself a poor position. What to do when a client leaves goes into the orderly version of the same ending.
