Email accounts are a favourite target for attackers: a guessed or phished password lets them send thousands of spam messages from your domain, which hurts deliverability for everyone. cPanel gives you the controls to change passwords, temporarily suspend an account and investigate what happened.
Before you start
- Access to cPanel for the domain.
- A password manager, so every mailbox has a long unique password.
Change a mailbox password
- Open cPanel → Email → Email Accounts.
- Click Manage next to the address.
- Under Security → New Password, type a new password or click Generate. Aim for 16+ characters.
- Click Update Email Settings.
- Give the new password to the mailbox owner through a safe channel, and update all their devices.
Tip: cPanel's password strength meter must reach the server's minimum. If the button is grey, the password is too weak.
Suspend or restrict an account
On the same Manage page you can control three things independently:
| Option | Effect | Use it when |
|---|---|---|
| Receiving Incoming Mail: Suspend | Mail is rejected for this address | A former employee's address should stop receiving |
| Sending Outgoing Email: Suspend or Hold | Outgoing mail is blocked, or queued for review | The account is sending spam |
| Logging In: Suspend | No webmail, IMAP or POP3 login | You suspect a stolen password |
Click Update Email Settings after changing. Unlike deleting, suspending keeps all stored mail.
If an account is compromised
Signs: bounce messages for mail you did not send, complaints from contacts, a sudden "max emails per hour exceeded" notice, or the account shown as suspended for outgoing mail by our team.
- Suspend outgoing mail for the address as above.
- Change the password to a new unique one.
- Scan the user's computer and phone for malware; many thefts come from infected devices or saved passwords in browsers.
- Check filters and forwarders the attacker may have added: Email → Forwarders, Email Filters and Roundcube Settings → Filters and Identities.
- Look at Track Delivery to see how much was sent and to whom. See Track Delivery.
- Open a support ticket. We can clear queued spam from the server and check whether the server IP needs delisting.
- When everything is clean, set outgoing mail back to Allow.
Keep mailboxes safe
- Never reuse an email password on other websites.
- Be careful with "your mailbox is full, log in here" messages: they are phishing. Real quota notices from cPanel never ask for your password via a link.
- Protect the cPanel account itself with two-factor authentication; a stolen cPanel login can reset every mailbox.
- Delete unused mailboxes rather than leaving them with old passwords.