A reseller login controls every customer account you sell. If someone steals the password, they can delete or deface all of them. Two-factor authentication (2FA) adds a six-digit code from your phone to every login, so a stolen password alone is not enough.
Before you start
- An authenticator app on your phone, such as Google Authenticator, Microsoft Authenticator, Authy or a password manager with TOTP support.
- Access to WHM or cPanel.
- The server time must be correct (it is on MdmHost servers); codes depend on time.
Enable 2FA for your reseller login
Your WHM login is your reseller cPanel user, so 2FA is set up in cPanel and then applies to both.
- Open your reseller cPanel (from WHM, click the cPanel link at the top, or log in at port 2083).
- Go to cPanel → Security → Two-Factor Authentication.
- Click Set Up Two-Factor Authentication.
- Scan the QR code with your authenticator app, or enter the secret key shown.
- Enter the six-digit code from the app and click Configure Two-Factor Authentication.
Log out and back in to WHM. After your password, you are asked for the current code.
Warning: Store the secret key or a backup of your authenticator somewhere safe, such as a password manager. Without it, losing your phone locks you out until support verifies your identity.
Enable 2FA for customers
Customers enable it themselves in the same place in their cPanel. Make sure Two-Factor Authentication is included in the feature lists of your packages (see Feature Manager), and encourage it in your welcome email.
If you lose your phone
- You (reseller): open a ticket from the MdmHost dashboard. After verification, MdmHost can remove 2FA so you can set it up again. You can also use the one-click WHM login from the dashboard, which signs you in through your MdmHost account.
- Your customer: open their cPanel from WHM without their password (see opening a customer cPanel), go to Security → Two-Factor Authentication and click Remove Two-Factor Authentication. Verify the customer's identity first.
Other login protections
- Use a long unique password (see changing passwords).
- Protect your MdmHost dashboard account with its own strong password, as it can open WHM in one click.
- Use API tokens instead of passwords in billing systems (see API tokens).
Troubleshooting
"The security code is invalid"
The phone's clock is off. Enable automatic time on the phone, or use the app's time sync option.
2FA is not in cPanel
The feature is disabled in the account's feature list, or disabled on the server. Check your feature list or ask support.
Frequently asked questions
Does 2FA affect email or FTP?
No. It protects cPanel, WHM and Webmail logins through the web interface. Mail clients and FTP keep using passwords.
Can I use SMS codes?
cPanel uses authenticator apps (TOTP), not SMS. App codes are more secure and work without mobile signal.
Does the dashboard one-click login skip 2FA?
It uses a single-use token created from your authenticated MdmHost dashboard session, which is why the dashboard account itself must be well protected.