Set Up Two-Factor Authentication for Your cPanel Account

cPanel two-factor authentication adds a time-based one-time code to the interactive account login. Your hosting administrator must make the feature available before you can enroll. Enabling it in WHM does not automatically enroll each cPanel user.

Prepare a private authenticator

Use a compatible TOTP authenticator on a device you control, with accurate time. Google Authenticator is one option, not the only supported application. Protect the device and any authenticator backup: possession of the enrollment secret allows another device to generate the same codes.

Enroll your own cPanel account

1. Sign in through your trusted cPanel HTTPS address. Open Security > Two-Factor Authentication, or locate the equivalent feature in your current theme.
2. Choose Set Up Two-Factor Authentication.
3. Scan the displayed QR code with your authenticator, or enter the displayed account/key information manually. Do not photograph or share the QR code in a support ticket.
4. Enter a current code and complete configuration. Keep a recovery path available before ending your existing session.
5. Test a new private browser session using both the password and a fresh code, then sign out of the test session.

If a code fails or a device is lost

Check the device’s automatic time setting, selected account and code expiry first. Avoid repeated guesses. Reconfiguration replaces the enrollment secret, so an old authenticator entry may stop working. If you cannot authenticate, ask the hosting administrator for identity-verified recovery; do not disable protection globally for all users.

Understand what it protects

TOTP reduces the risk from a stolen password but can still be phished. Use a trusted login address and a unique password. Do not assume interactive 2FA automatically protects all API requests: cPanel documents separate security-policy extensions for API access, and API tokens require their own permission and revocation controls.

Reference: cPanel two-factor authentication.

Reviewed October 15, 2026. Documentation review; no enrollment, recovery or live login test was performed.