Your cPanel password protects everything on your hosting account: files, databases, email and DNS. Change it if you shared it, if someone who knew it left your team, or if you suspect a breach. This guide also lists the other settings that keep the account safe.
Before you start
- Generate a new password with a password manager: at least 16 characters, unique to this account.
- Note any tools that log in with the cPanel username and password, such as an FTP client using the main account, a backup service or a desktop database tool. You must update them afterwards.
Change the password in cPanel
- Log in to cPanel and open the user menu (top right) → Password & Security, or cPanel → Preferences → Password & Security.
- Enter the Old Password.
- Enter the New Password twice, or click Password Generator, tick that you copied it and click Use Password.
- Leave Enable Digest Authentication off unless you use Web Disk on old Windows versions.
- Click Change your password now! You will be logged out and asked to log in again.
Note: If you forgot the current password, open cPanel with one click from Services in the MdmHost dashboard. Password changes for hosting accounts can also be made from the service page in the dashboard where available.
What the cPanel password is used for
| Login | Uses the cPanel password? |
|---|---|
| cPanel at port 2083 | Yes |
| Main FTP account (cPanel username) | Yes |
| SSH and SFTP with password | Yes (keys are better) |
| Webmail for the cPanel user's default mailbox | Yes |
Email accounts like you@domain.com | No, each has its own password |
| Extra FTP accounts and MySQL users | No, each has its own password |
| WordPress or shop admins | No |
Security checklist for your account
- Turn on two-factor authentication.
- Use separate FTP accounts for developers, limited to one folder, and delete them afterwards.
- Give team members their own logins in Preferences → User Manager with only the services they need (email, FTP, Web Disk).
- Set a contact email outside this account in Contact Information and enable login and password-change notifications.
- Keep CMS, plugins and themes updated. Enable automatic updates in Softaculous if you installed apps there.
- Use SSH keys instead of passwords for shell access.
- Review SSL/TLS Status so every domain uses HTTPS.
If you think the account was compromised
- Change the cPanel password and all CMS admin passwords.
- Check Email → Forwarders and Cron Jobs for entries you did not create.
- Look for recently changed files (see Terminal commands) and restore clean files from JetBackup.
- Open a support ticket; we can scan the account and review logs.