Two-Factor Authentication and Password Policies in cPanel & WHM

If someone gets the password to WHM, they own every website and mailbox on the server; if they get a cPanel password, they own that business's site, email and databases. The fix is layered: turn on the Two-Factor Authentication policy in WHM, require 2FA for root, resellers and staff, raise Password Strength Configuration and enforce it for existing accounts in Configure Security Policies, extend those policies to API requests, and replace shared passwords with scoped API tokens. Here is how to do each step with the menu names cPanel uses today, and where 2FA does not reach.

How 2FA works in cPanel & WHM

cPanel & WHM uses time-based one-time codes from an authenticator app. cPanel's documentation names Google Authenticator and Duo Mobile as supported apps; most standard TOTP apps work the same way. After the password, the user types the six-digit code from the phone.

Two details matter before you roll it out:

• The server clock must be right. If users see "The security code is invalid" while setting up, cPanel's docs point to an incorrect server time. Keep NTP or chrony running.
• WHM cannot switch it on for cPanel users. Root enables the server-wide policy; each cPanel user then sets up 2FA in their own account.

Step 1: Enable the policy in WHM

1. Log in to WHM as root and open WHM » Security Center » Two-Factor Authentication for WHM.
2. Set the toggle to On. The page confirms "The Two-Factor Authentication Security Policy is Enabled."
3. In the Settings tab, set an Issuer name (for example, your company name) so users can recognize the entry in their app. If left blank, it uses the server hostname.

Set up 2FA for root and resellers

In the Manage My Account tab, click Set Up Two-Factor Authentication, scan the QR code, enter the code and click Configure Two-Factor Authentication. Resellers do the same from their WHM login. cPanel notes that resellers need the Create Accounts privilege to use 2FA in WHM.

Step 2: Have every cPanel user turn it on

Each user goes to cPanel » Security » Two-Factor Authentication, clicks Set Up Two-Factor Authentication, scans the code and confirms it. Give your clients or staff a one-page instruction sheet and a deadline.

You can track progress in WHM's Manage Users tab, which lists the accounts that have 2FA enabled.

Plan for lost phones

cPanel's own guidance is blunt: without the phone, the user cannot log in. There is no self-service recovery code, so decide in advance:

• Who can reset 2FA (root or a designated administrator) and how they verify the person asking, for example by a call-back to a known number.
• How to reset it: in Manage Users, click Disable next to the account, then have the user set it up again.
• Where root's backup lives: store root's 2FA secret or a second enrolled device in your password manager or safe, and keep console access for emergencies.

Step 3: Set and enforce password strength

Password Strength Configuration

Open WHM » Security Center » Password Strength Configuration. cPanel rates passwords from 0 to 100 and recommends a Default Required Password Strength of 40 or higher. You can set stricter values for individual features, such as email or FTP accounts, which are favorite targets.

Enforce it on existing accounts

By default, new strength rules apply only to new passwords. To enforce them on accounts that already exist, open WHM » Security Center » Configure Security Policies and select Password Strength.

Rethink password expiry

The same page offers Password Age, which forces changes after a set number of days. Current NIST guidance (SP 800-63B-4) recommends long passwords checked against a blocklist of common and breached passwords, and says verifiers should not require periodic changes, only a change when there is evidence of compromise. For most businesses, longer passphrases plus 2FA beat 90-day rotation, which tends to produce predictable passwords. If a compliance framework you follow requires rotation, follow it and document it.

Close the shell loophole

cPanel points out that users with shell access can bypass strength rules using the passwd command. Give shell access only to accounts that need it.

Step 4: Extend policies to API requests

Integrations are often the weakest link. In Configure Security Policies, the Security Policy Extensions section has an API requests option that applies your policies (including 2FA) to WHM API calls authenticated with a username and password. cPanel's documentation notes that without it, password-authenticated API calls can bypass the 2FA challenge.

The better pattern is to stop using passwords for automation altogether:

• In WHM » Development » Manage API Tokens, create one token per integration with a clear name.
• Deselect every privilege the integration does not need. cPanel specifically warns about Everything, Change Password, Create User Session and Manage API Tokens.
• Set an expiration date and restrict the token to the integration's IP addresses.
• cPanel users can do the same in cPanel » Security » Manage API Tokens.

Step 5: Optional extra layers

WHM interface	What it adds	When to use it
Configure Security Policies » Limit logins to verified IP addresses	Security questions when someone logs in from an unrecognized IP	Small admin teams with stable locations
Security Questions	Manages your questions and recognized IP addresses	Together with the option above
Host Access Control	Allows or blocks services such as WHM and SSH by IP	When admins work from fixed IPs or a VPN
cPHulk Brute Force Protection	Blocks IPs and accounts after repeated failed logins	Always

What 2FA does not cover

2FA protects the cPanel, WHM and Webmail web logins. It does not add a code prompt to:

• Email clients connecting by IMAP, POP3 or SMTP, which still use the mailbox password.
• FTP accounts, which should be replaced with SFTP where possible.
• SSH, which should use keys rather than passwords (see WHM's SSH Password Authorization Tweak).
• API tokens, which are exempt from 2FA by design, so their scope and IP limits matter.

That is why strong, unique mailbox passwords and cPHulk still matter after 2FA is on.

Account hygiene checklist

1. 2FA policy enabled; root, resellers and staff enrolled.
2. Users given a setup sheet and a deadline; progress checked in Manage Users.
3. A written process for resetting 2FA after a lost phone.
4. Password strength of 40 or more, enforced for existing accounts.
5. API requests covered by security policies; integrations moved to scoped, expiring tokens.
6. Shell access limited; SSH key-only.
7. Former employees' accounts, tokens and SSH keys removed the day they leave.

Need help rolling it out?

Turning on 2FA for one admin takes minutes; getting every client and employee enrolled without locking anyone out takes planning. Max, our founder, is cPanel & WHM certified, and our team helps businesses across Miami-Dade and South Florida secure their hosting accounts, in English or Spanish. Request a free IT assessment and we will review your WHM login security with you.

Sources

• Two-Factor Authentication for WHM – cPanel & WHM Documentation
• Two-Factor Authentication for cPanel – cPanel & WHM Documentation
• Password Strength Configuration – cPanel & WHM Documentation
• Configure Security Policies – cPanel & WHM Documentation
• Manage API Tokens in WHM – cPanel & WHM Documentation
• NIST SP 800-63B-4: Authentication and Authenticator Management