Protect your cPanel account with two-factor authentication

Two-factor authentication adds a second proof of identity to a password. Availability depends on the provider. Protect the email address used for account recovery as carefully as cPanel itself.

Enrol carefully

1. Sign in from the known hosting address and find Two-Factor Authentication if enabled.
2. Set up the supported authenticator on a trusted device. Keep the device’s clock accurate.
3. Complete verification and save any provider-supported recovery information privately.
4. Test a fresh login before signing out of the existing session.
5. Record the provider’s identity-verification process for a lost authenticator.

Protect the secret

The enrolment QR code contains a secret, not a public image. Do not send it to a contractor, paste it into a support ticket or keep it in a public photo album. A one-time code should be entered only into the intended service’s verified login screen.

Do not remove the old authenticator until a device migration and recovery plan have been tested. A password manager, account alerts and separate team accounts complement 2FA but do not replace it.

cPanel 2FA is separate from authentication in WordPress, a billing portal or this website’s CMS. Review each system independently. Contact the provider through the established recovery channel if access is lost; do not follow unsolicited messages offering to “reset” the account.