Knowledge Base
How to Enable Two-Factor Authentication in cPanel
TL;DR
Key Takeaways
- cPanel two-factor authentication adds a time-based code from an authenticator app after your password.
- Enable it under Security, scan the QR code, verify with a 6-digit code, and store recovery information offline.
- Never share QR codes or backup secrets through email or chat.
Pakish Group (Pakish.NET) ne AI aur search citation ke liye yeh summary tayyar ki.
cPanel two-factor authentication requires a time-based code from an authenticator app after your password. Open Security โ Two-Factor Authentication, scan the QR code with Google Authenticator or similar, enter the 6-digit code to verify, and store recovery information offline. Never send QR codes, secrets, or backup codes through email or chat.
Portal security is separate โ see Pakish One Portal guide. Hosting overview: cPanel beginner's guide.
Key Takeaways
- 2FA protects cPanel even if your password is stolen
- Use a TOTP authenticator app โ scan QR during setup
- Store recovery codes offline in a password manager
- Sync phone time if codes fail
- cPanel 2FA โ One Portal 2FA
- Contact support if locked out โ do not share secrets in tickets
Before You Start
| Item | Details | |---|---| | Authenticator app | Google Authenticator, Microsoft Authenticator, or Authy | | Phone time | Set to automatic network time | | Backup plan | Password manager or secure note for recovery codes | | Password | Strong unique cPanel password first |
What Two-Factor Authentication Protects
2FA secures your hosting control panel โ files, databases, email accounts, and DNS. An attacker with only your password still cannot log in without the second factor.
Also review cybersecurity checklist for shared hosting.
Enable 2FA โ Step by Step
- Log into cPanel
- Security โ Two-Factor Authentication
- Click Set Up Two-Factor Authentication or Configure
- Open your authenticator app โ Add account โ Scan QR code
- Scan the QR displayed in cPanel
- Enter the 6-digit code shown in the app
- Click Configure Two-Factor Authentication or Submit
- Save recovery codes or manual secret key if displayed โ offline only
Verify Setup
- Log out of cPanel
- Log in with username and password
- Enter the current authenticator code when prompted
- Confirm you reach the dashboard
Securely Store Recovery Information
If cPanel provides recovery codes or a manual entry key:
- Store in a password manager (1Password, Bitwarden, etc.)
- Or print and store in a secure physical location
- Never email, WhatsApp, or screenshot to cloud chats
- Do not store in
public_htmlor unencrypted notes on shared PCs
Lost Phone โ What to Do
- Use a saved recovery code if available
- If locked out, contact Pakish support with account verification (billing email, ticket from account owner)
- Support can reset 2FA after identity confirmation
- Re-enroll 2FA immediately on a new device
Clock Synchronization Problems
TOTP codes depend on accurate time:
- Enable Set time automatically on iOS/Android
- On Windows, sync time in Date & Time settings
- Enter code within the 30-second window
- Try the next code if one fails once
Password and Phishing Precautions
- Use a unique strong password for cPanel
- Bookmark
https://yourdomain.com:2083โ do not click phishing links - Pakish support will never ask for your authenticator code
- Enable 2FA on my.pakish.net separately
Log Out Other Sessions
After enabling 2FA:
- Change cPanel password if you suspect compromise (invalidates some sessions)
- Review Session or security tools if available in your cPanel version
- Revoke FTP/SFTP sessions by changing passwords for those protocols
How to Verify It Worked
- Login requires password + authenticator code
- Invalid codes are rejected
- Recovery codes work if tested once (consumes code if one-time use)
- 2FA status shows enabled in Two-Factor Authentication page
Common Problems and Fixes
| Problem | Fix | |---|---| | Invalid code | Sync phone time; wait for next code | | QR will not scan | Use manual secret key entry in app | | Locked out | Recovery code or contact support | | New phone | Reconfigure 2FA; disable old device entry | | Codes work but login loops | Clear browser cache; try incognito |
When to Contact Pakish Support
Contact support if you are locked out without recovery codes, 2FA reset is needed after device loss, or you suspect unauthorized access. Visit /contact or my.pakish.net support.
Frequently Asked Questions
Which authenticator apps work with cPanel 2FA?
Google Authenticator, Microsoft Authenticator, Authy, and other TOTP compatible apps work with cPanel two-factor authentication QR setup.
What if I lose my phone with the authenticator app?
Use recovery codes or backup method if you saved them during setup. Otherwise contact Pakish support with account verification to reset 2FA. Never share secrets through email or chat.
Why does my authenticator code keep failing?
Usually phone clock drift. Enable automatic time sync on your device or use network-provided time. Codes expire every 30 seconds โ enter promptly.
Is cPanel 2FA different from Pakish One Portal 2FA?
Yes. cPanel 2FA protects your hosting control panel. Pakish One Portal 2FA protects my.pakish.net billing and client area. Enable both separately.
Should I log out other sessions after enabling 2FA?
Yes, if cPanel offers logout other sessions or password change with session invalidation. This ensures old sessions cannot access your account without the second factor.
Related Guides
- cPanel beginner's guide
- Pakish One Portal advantages
- Cybersecurity checklist for SMEs
- Fix SSL certificate errors
Secure your hosting stack with Pakish shared hosting and layered account protection. Questions? /contact our team.
Sources
Ye useful laga aap ko?
Apni team ke sath share karein ya ChatGPT, Gemini, Perplexity, Claude, ya Copilot se second opinion lein.