Skip to main content
Two-factor authentication (2FA) adds a second step to your cPanel login. After you enter your password, you enter a 6-digit code from your authenticator app. Use it to protect your hosting account if your password is leaked or guessed.

​
Prerequisites

  • Access to cPanel. Log in through the console or directly at https://yourdomain.com:2083 or https://server-hostname:2083
  • An authenticator app on your phone, such as Google Authenticator, Authy, Microsoft Authenticator, 1Password, or Bitwarden
1

Log in to cPanel

Log in to cPanel. If you log in through the console, open Services, click the hosting account, then click Log in to cPanel. You need the Manage services permission on the billing account.
2

Open Two-Factor Authentication

In cPanel, go to the Security section and click Two-Factor Authentication.If you do not see it, use the search bar at the top and type Two-Factor Authentication.
3

Start setup

Click Set Up Two-Factor Authentication.cPanel shows a QR code and a 16-character secret key.
4

Scan the QR code

Open your authenticator app and scan the QR code.If you cannot scan, enter the secret key manually in your app. The app then starts generating 6-digit codes for this account.
5

Confirm the code

Enter the current 6-digit code from your app in the Security Code field and click Configure Two-Factor Authentication.cPanel confirms that 2FA is now active.
6

Test your next login

Log out and log in again. After your password, cPanel now asks for the 6-digit code from your app.

​
Manage or disable 2FA

To remove 2FA later, return to Security and click Two-Factor Authentication, then click Remove Two-Factor Authentication. You need a valid code to confirm removal.
Save the secret key or take a screenshot of the QR code and store it in a secure place, such as a password manager. If you lose your phone, you need the secret to restore the codes. Without it, contact support to reset 2FA after identity verification.
Each code is valid for about 30 seconds. If your phone clock is off, codes may fail. Enable automatic time sync on your device.
Last modified on October 31, 2026