Setting Up Two-Factor Authentication for Your cPanel Login
Two-factor authentication (2FA) adds an extra layer of security to your cPanel account by requiring both your password and a temporary code from your mobile device to log in. This significantly reduces the risk of unauthorized access, even if your password is compromised.
Prerequisites
- A smartphone or tablet with a 2FA app installed, such as:
Setting Up 2FA in cPanel
- Log in to your cPanel account at https://{hostname}.mysecureservers.com:2087
- In the search box at the top, type "Two-Factor Authentication" or navigate to the SECURITY section
- Click on Two-Factor Authentication
- Click Set Up Two-Factor Authentication
- The system will display a QR code
- Open your authenticator app on your mobile device
- Tap the "+" or "Add" button in your authenticator app
- Scan the QR code displayed in cPanel
- Once the app recognizes the code, it will start generating 6-digit codes that change every 30 seconds
- Enter the current 6-digit code from your authenticator app in the "Verification Code" field in cPanel
- Click Verify Code
- If successful, you'll see a confirmation message that 2FA is now active
Backup Recovery Codes
After setting up 2FA, cPanel will provide you with recovery codes. These are extremely important:
- cPanel will display several recovery codes
- These codes can be used once each if you lose access to your authenticator app
- Important: Save these recovery codes in a secure location (not on your computer)
- Consider printing them and storing them in a safe place
Logging In with 2FA Enabled
Once 2FA is set up, the login process will change:
- Enter your username and password as usual
- You'll be prompted for a verification code
- Open your authenticator app and enter the current 6-digit code
- Click Log in
Disabling 2FA (If Needed)
- Log in to cPanel using your password and verification code
- Go to Two-Factor Authentication
- Click Disable Two-Factor Authentication
- Confirm your decision
Setting up 2FA is one of the most effective security measures you can take to protect your hosting account from unauthorized access. We strongly recommend enabling this feature for all your important accounts.