Enable two-factor authentication (2FA) in cPanel

Two-factor authentication (2FA) asks for a six-digit code from your phone after your password. Even if someone steals or guesses your cPanel password, they cannot log in without the phone. It takes two minutes to set up and is the single best step to protect your hosting account.

Before you start

• An authenticator app on your phone: Google Authenticator, Microsoft Authenticator, Authy, 1Password, Bitwarden or any app that supports TOTP codes.
• The correct time on your phone (set to automatic). Codes depend on the clock.

Turn on 2FA

1. Log in to cPanel and open cPanel → Security → Two-Factor Authentication.
2. Click Set Up Two-Factor Authentication.
3. Open the authenticator app, choose Add account → Scan QR code, and scan the code on screen.
4. If you cannot scan, choose manual entry in the app and type the Account name and Key shown under the QR code.
5. Type the six-digit code from the app into Security Code and click Configure Two-Factor Authentication.
6. cPanel confirms 2FA is enabled. Next time you log in with a password, it asks for a code.

How logins work with 2FA

• Direct login at yourdomain.com:2083: password, then the code.
• One-click login from the MdmHost dashboard (Services → Login to cPanel): uses single sign-on and does not need the code, so protect your dashboard login with a strong password too.
• 2FA protects the cPanel login only. Email accounts, FTP and databases use their own passwords.

If you lose your phone

1. Log in to the MdmHost dashboard and open cPanel from Services. Single sign-on skips the code.
2. Go to Security → Two-Factor Authentication and click Remove.
3. Set it up again with your new phone.

If you cannot access the dashboard either, open a support ticket or contact us. For your security we will verify account ownership before disabling 2FA.

Reconfigure or remove

On the same page you can Reconfigure (new QR code, old codes stop working) or Remove 2FA. Do this when you change phones or when a staff member who had the code leaves.

Troubleshooting

• "The security code is invalid": the phone clock is off. Turn on automatic time and try again. Use the current code, not one about to expire.
• Two Factor Authentication missing: the feature may be disabled on the server; contact support.
• Several people share the account: better to give each person their own access with User Manager rather than share one login and code.

Next steps

• Change your cPanel password
• Block attackers with IP Blocker
• Use SSH keys