cPanel runs its own small web server, cpsrvd, separate from the main site web server. It answers on six fixed cPanel ports: one plain and one encrypted port each for cPanel, WHM and Webmail. Knowing what these ports do helps you log in from restrictive networks and set firewall rules correctly.
Before you start
- A cPanel account or a WHM (reseller or root) login.
- Your server hostname or domain.
The six cPanel ports
| Service | Plain port | SSL port | URL example |
|---|---|---|---|
| cPanel | 2082 | 2083 | https://example.com:2083 |
| WHM | 2086 | 2087 | https://server.example.com:2087 |
| Webmail | 2095 | 2096 | https://example.com:2096 |
The even-numbered ports (2082, 2086, 2095) are unencrypted. Your password would cross the network in clear text, so always use the odd SSL ports. Many servers redirect the plain ports to the SSL ones automatically.
Why cPanel does not use 443
Port 443 belongs to the website web server (LiteSpeed or Apache), which serves your domain. cpsrvd needs its own ports so the panel keeps working even if the site's web server is stopped, misconfigured or overloaded. That separation is also why you can still reach cPanel to fix a broken .htaccess.
Proxy subdomains: cPanel without a port number
When proxy subdomains are enabled in WHM, the site web server forwards these hostnames to cpsrvd internally:
cpanel.example.com→ cPanelwebmail.example.com→ Webmailwhm.example.com→ WHM
These use normal port 443, so they work on office, hotel and school networks that block unusual ports. Root users toggle them in WHM → Server Configuration → Tweak Settings → Domains ("Proxy subdomains").
Log in easily from MdmHost
You rarely need to type a port at all: in the MdmHost dashboard, open Services and use the one-click login to cPanel or WHM. See log in to cPanel from the MdmHost dashboard.
Opening the ports on your own server
If you run a cPanel VPS or dedicated server, the firewall must allow TCP 2083, 2087 and 2096 inbound (and 2082/2086/2095 if you have not disabled the plain ports). In CSF they are already in TCP_IN by default. To restrict WHM to your office IP, allow 2087 only from that address and remove it from the public list.
Troubleshooting
- Connection times out on :2083: the network you are on blocks the port. Use
cpanel.yourdomaininstead, or the dashboard login. - Certificate warning on :2087: you used an IP or a hostname without a valid certificate. Use the server hostname, which AutoSSL covers.
- Your own IP got blocked after failed logins: cPHulk or the firewall locked you out. Contact support with your IP from the IP checker.
FAQ about cPanel ports
Which port do I use for cPanel?
2083 (SSL). Use 2087 for WHM and 2096 for Webmail.
Can resellers use port 2087?
Yes. Reseller accounts log in to WHM on 2087 with their own limited permissions.
Can I change the cPanel ports?
No, they are fixed in cPanel. Use proxy subdomains if you need standard ports.