Customers forget passwords, and a compromised account needs a new one right away. As a reseller you can set a new cPanel password for any of your accounts from WHM without knowing the old one.
Before you start
- WHM access (see logging in to WHM).
- Confirmation that the request really comes from the account owner, for example from the email address on file.
Change the password
- Log in to WHM.
- Go to WHM → Account Functions → Password Modification.
- Select the account by username or domain.
- Type a new password or click Password Generator to create a strong one. Copy it before closing the generator.
- Decide about Enable Digest Authentication. Leave it off unless the customer uses Web Disk on old Windows versions.
- Decide about Change the MySQL password (explained below).
- Click Change Password.
The MySQL password option
The cPanel account has a main MySQL user with the same name as the account. If you tick the MySQL option, that user's password changes too. Websites normally use their own database users (such as user_wp123), so they keep working either way. Only tick it if you know the site connects with the main cPanel user, and then update the site's configuration file.
Note: The password strength meter must reach the minimum set on the server. Strong passwords use 12+ characters with upper and lower case letters, numbers and symbols.
Share the new password safely
- Do not send it in the same email as the username and server address.
- Use a one-time secret link or a support ticket instead of chat.
- Ask the customer to change it themselves in cPanel → Preferences → Password & Security and enable Two-Factor Authentication.
After a security incident
If the account was hacked, a new cPanel password is only the first step. Also change FTP, email and database user passwords, update WordPress admin passwords and scan the account. See scanning a website with Imunify360 and cleaning infected files.
Troubleshooting
"The password you selected cannot be used"
It is too weak or contains the username. Use the generator.
The customer still cannot log in
Several failed attempts may have blocked their IP in cPHulk or Imunify360. Ask for their IP from the IP checker and see unblocking an IP.
Email clients stopped working
Changing the cPanel password does not change mailbox passwords, but the default (cPanel user) mailbox uses the new one. Update it in the email client.
Frequently asked questions
Can I see a customer's current password?
No. cPanel stores passwords as one-way hashes, so nobody, including MdmHost, can read them. You can only set a new one.
Does this change the reseller's own password?
Only if you select your own account. To change your WHM login, change the password of your reseller cPanel account.
Will changing the password log the customer out?
Yes. Existing cPanel and Webmail sessions end and the customer must sign in again with the new password.
Does it change FTP passwords?
Only the main FTP account, which uses the cPanel login. Extra FTP accounts created in cPanel keep their own passwords.