Configure WHM Two-Factor Authentication with the Right Scope

WHM’s two-factor authentication controls have two jobs: enabling the server policy and enrolling a particular WHM account. Enabling the policy does not automatically enroll every cPanel user or protect every API credential.

Plan administrator recovery

Use authorized WHM access, a trusted HTTPS hostname and a supported TOTP authenticator. Confirm accurate clocks and the host’s recovery process before enrollment. Keep QR codes and setup keys private: anyone with a copied seed can generate the same codes.

Enable the appropriate server policy

In Security Center > Two-Factor Authentication, review the policy and issuer settings for the installed version. Check integration compatibility and authorized recovery access before enabling it. Do not treat the setting as proof that all accounts have enrolled.

Enroll your WHM account

1. Use Manage My Account for the intended root or eligible reseller account.
2. Choose Set Up Two-Factor Authentication and scan the QR code, or enter its account/key details into the authenticator privately.
3. Enter the current generated code and complete configuration.
4. Verify a fresh permitted login with both factors before relying on the setup; keep the recovery process available.

Separate cPanel users and integrations

Individual cPanel users enroll through their own cPanel interface. Password-authenticated API requests have separate security-policy settings; API tokens require their own privilege/lifetime review. Review those paths rather than claiming a TOTP toggle covers every integration or defeats phishing/session theft.

Reconfiguration replaces the existing authenticator setup. For a lost device or invalid code, check clocks and use an authenticated administrator recovery route instead of sharing a seed or disabling 2FA server-wide.

Reference: WHM 2FA scope, enrollment and API policy.

Reviewed October 15, 2026. No policy, authenticator seed or live login was changed or tested.