Change the root password on a cPanel server safely (root guide)

The root password unlocks everything on a cPanel server: WHM, SSH and every account. Change it after staff changes, after sharing it with a contractor, or if you suspect it leaked. Better still, rely on SSH keys and API tokens so the password is rarely used.

MdmHost manages root access on its hosting plans. This guide is for administrators of their own VPS or dedicated server.

Before you start

• Current root access to WHM or SSH.
• A password manager to generate and store the new password.
• Your provider's console access in case something goes wrong.

Change it in WHM

1. Log in to WHM as root.
2. Go to WHM → Server Configuration → Change Root Password.
3. Enter the new password twice, or use the password generator; check that it is strong.
4. Click Change Password.

Change it from SSH

passwd root

Enter the new password twice. WHM uses the same system password, so the change applies to WHM logins too.

After changing

• Update any tools that log in as root with a password, such as old backup scripts or remote management tools. Replace them with SSH keys or API tokens where possible.
• Billing systems should use API tokens, not the root password (see API tokens).
• Check WHM → Server Contacts → Contact Manager notifications for root logins so you notice unexpected access (see Contact Manager).

Move away from password logins

1. Create an SSH key pair and add the public key for root (see setting up SSH keys).
2. Test key login.
3. Disable SSH password authentication in WHM (see Security Advisor).
4. Enable two-factor authentication for WHM root logins in WHM → Security Center → Two-Factor Authentication.

If you are locked out

Use your provider's rescue or console mode to reset the root password. Then review logs for unauthorised access before putting the server back into service.

Frequently asked questions

How long should the root password be?

At least 16 random characters from a password manager. Nobody should need to remember it.

Does changing it affect cPanel users?

No. Customer passwords are separate; only root logins change.

Should I share root with developers?

Avoid it. Give developers SSH keys on their own accounts or temporary access, and remove it afterwards.

Will changing the root password log out WHM sessions?

Existing sessions may continue until they expire; log out and back in to confirm the new password works.

Where can I see who logged in as root?

Check /var/log/secure for SSH and /usr/local/cpanel/logs/login_log for WHM logins.

How often should I change it?

When people with access change or a leak is suspected. With SSH keys and 2FA in place, routine rotation matters less.