Configure WHM Password Strength and Understand Enforcement Limits

WHM’s Password Strength Configuration sets minimum scores for supported password-setting interfaces. A score is an interface policy, not proof that a password is unique, uncompromised or resistant to every attack.

Set an intentional requirement

1. As an authorized WHM administrator, open Security Center > Password Strength Configuration.
2. Review the default and service-specific requirements. Record the existing policy before changing it.
3. Choose the intended scores and save. cPanel documents a 0-100 scale and rounding entered values upward to a multiple of five.
4. Verify the relevant password-setting workflow with a controlled account, without sharing the password or disrupting a customer login.

Understand default and existing-account scope

The default strength value affects newly created accounts; changing it is not the same as forcing all existing users to replace their passwords. cPanel documents separate Password Strength policy handling under Configure Security Policies for existing accounts. Inspect that scope before enabling enforcement.

Individual services can have their own requirements. Shell tools such as passwd do not necessarily enforce WHM’s interface score, so do not claim the slider is an all-path server authentication control. In linked-node configurations, review cPanel’s documented parent/child behavior rather than assuming a local setting governs every node.

Use additional controls

Encourage long unique passwords stored in a password manager, protect recovery routes and use available MFA. A high score does not detect every reused or leaked password, and arbitrary extra complexity is not a substitute for those controls. Test the actual supported workflows before communicating a new policy to users.

References: Password Strength Configuration and enforcement limits; existing-account security policies.

Reviewed October 15, 2026. Documentation review; no live password policy or customer account was changed.