Configure WHM Password Age Only for an Approved Policy

WHM can enforce a maximum password age through Configure Security Policies. This is a configurable administration feature, not a recommendation that every hosting account should change its password on an arbitrary schedule or a statement of InterServer’s current service-wide policy.

Decide whether age-based expiry is appropriate

Current NIST digital-identity guidance discourages arbitrary periodic password changes and calls for replacement when there is evidence of compromise. Long unique passwords, protected recovery paths and appropriate MFA address different risks. If your organization has a specific expiry requirement, document its reason, scope and recovery process instead of picking an unexplained number of days.

Configure an approved WHM policy

1. Use an authorized WHM administrator account and open Security Center > Configure Security Policies.
2. Record the existing settings and review the Password Age option and maximum-age field in your installed version.
3. Before enabling or shortening an expiry period, assess existing account ages, user notification, automation dependencies and access to verified recovery support.
4. Apply only the approved value and inspect the actual enforcement scope. Security-policy extensions for API requests are separate options, not an automatic consequence of enabling an interactive policy.
5. Verify with a controlled test account and retain recovery access. Do not use a customer’s production login as an unannounced test.

Respond to compromise separately

Do not wait for an age threshold when a password has been exposed or reused. Use the verified account recovery route, replace the affected credential and investigate sessions, tokens and suspicious changes as applicable. Conversely, a successful password rotation does not prove that an account is clean.

If you are a hosting customer rather than a server administrator, ask support about the policy that actually applies to your account. This guide does not establish or change InterServer retention, migration or authentication commitments.

References: WHM security-policy controls; NIST SP 800-63B authentication guidance.

Reviewed October 15, 2026. Documentation review; no password expiry or account policy was changed.