How to Secure Your cPanel Hosting Account: Passwords, 2FA and Who Has Access

A cPanel hosting account isn't usually broken into — it's logged into, using a password that was already sitting in a leaked-credentials list from some unrelated website. Automated credential-stuffing tools try millions of previously leaked username-and-password pairs against unrelated logins, and 2026 industry data has tracked that kind of traffic growing sharply year on year. A hosting account is a high-value target for it: whoever holds it can change DNS records, read every mailbox on the domain, or quietly plant code on a live website. None of that needs a sophisticated attack. It needs one reused password. This guide sets out what actually reduces that risk, roughly in order of impact, then covers the other doors into a hosting account that people forget, a step-by-step setup you can finish in an afternoon, the signs of a compromise and what to do about one, and the habits that keep the account safe after the initial setup.

Start with a password you've never used anywhere else

Password reuse is the single biggest reason hosting accounts get taken over. Security research in 2026 has repeatedly found that a large share of a typical person's passwords are shared across multiple accounts — so a leak at some completely unrelated website can hand an attacker the exact password sitting on your hosting account too, without them ever touching your host directly. A password manager solves this cleanly: it generates a long, random password for cPanel that you never have to remember or reuse, and fills it in for you. Avoid predictable patterns like a company name plus a year — those are among the first combinations automated tools try.

Turn on two-factor authentication

cPanel includes a built-in two-factor authentication (2FA) feature, usually found under Security → Two-Factor Authentication in your account. Once it's set up, logging in needs both your password and a six-digit, time-based code from an authenticator app on your phone — a code that changes every 30 seconds and that an attacker on the other side of the world simply doesn't have. This one setting is what actually stops most credential-stuffing attempts in practice: even a leaked or reused password isn't enough on its own once 2FA is switched on. Set it up once and it applies to every future login.

The other doors into a hosting account

The cPanel login is the front door, but a hosting account has several others, and an attacker who cannot get through the front will try the rest. Each has its own password and its own setting to check.

Give every person their own login, never a shared one

A single cPanel login shared between a business owner, a staff member and a freelance developer feels convenient right up until something goes wrong — and then there's no way to tell who made a change, and no way to remove one person's access without changing the password for everyone else too. Creating a separate login for each person who genuinely needs access keeps that control real instead of theoretical, and makes the next step possible.

Remove access the same day someone leaves

Access that isn't actively revoked tends to just sit there. When an employee, freelancer or agency relationship ends, their hosting access should be removed the same day — not "at some point," and not only once someone remembers. That includes any login they had, any email account tied to that person, and, if a password was ever shared with them directly, changing it. The same offboarding logic applies to other company tools; our guide to what happens to a digital name card when an employee leaves covers one that is often forgotten.

Check the login history occasionally

Most cPanel accounts keep a record of recent logins, including the date, time and IP address. Glancing at it every so often — especially after finishing a project with an outside developer, or after any password change — is a quick way to catch unauthorised access early: a login from an unfamiliar location, or at a time nobody on the team was working, is worth investigating immediately rather than assuming it was nothing.

Securing the account in one afternoon, step by step

1. Install a password manager and generate a new, unique cPanel password; save it there.
2. In cPanel, open Security → Two-Factor Authentication, scan the code with an authenticator app, and save the backup codes somewhere safe and offline.
3. Do the same for the hosting client area login and the recovery email address.
4. Open the FTP Accounts tool and delete every account you do not recognise or no longer use.
5. Open Email Accounts and change the password on any mailbox that has ever been shared or belonged to someone who has left.
6. Open the CMS admin, enable 2FA through a plugin, rename or replace any "admin" user, and remove users who have left.
7. Check the API tokens and app passwords page and revoke anything unfamiliar.
8. Confirm the contact email on the hosting account and the domain is one you personally control.
9. Switch on domain lock at the registrar; see domain lock explained.
10. Write down who has which login, so the next offboarding is a checklist rather than a memory test.

If something looks wrong, act immediately

If you suspect an account has been accessed by someone else, change the cPanel password straight away, from a device you trust. Then check for anything that wasn't set up deliberately: new email forwarders or auto-responders (a common way a compromised mailbox gets used quietly), unfamiliar files, or cron jobs nobody on the team recognises. Contact your hosting provider's support team to help review the account — the sooner unauthorised access is found, the smaller the damage.

Signs of a compromise, and what each one means

Restoring from a backup is only half the fix: if the password or the plugin that let the attacker in is unchanged, the same thing happens again within days. Our backup guide covers how to restore to a clean copy.

Keeping it secure after the setup

• Review access quarterly. Who has a login, and do they still need it?
• Offboard on the day. Remove logins and change shared passwords the day someone leaves.
• Keep the CMS updated. Outdated plugins are the usual way into a site that has 2FA on cPanel.
• Glance at the login history monthly. It takes thirty seconds.
• Keep backup codes somewhere safe. Losing the authenticator phone without them locks you out too.
• Treat password-reset emails with suspicion. Go to the site directly rather than clicking.

Common mistakes

• Reusing the business email password for cPanel. One leak opens both.
• Sharing one login with the whole team. No audit trail, no clean offboarding.
• Leaving a departed developer's FTP account in place. It works for years after they leave.
• Assuming cPanel 2FA covers WordPress. It does not; the CMS needs its own.
• Skipping the backup codes. A lost phone becomes a lockout.
• Putting the recovery email on a mailbox anyone can reset. The weakest link resets the strongest.
• Restoring a hacked site without closing the hole. It is reinfected within the week.

Where Gotka Technologies fits

Gotka's Cloud Hosting plans run on cPanel over LiteSpeed servers, with free SSL, daily backups and free migration included, and 24/7 support to fall back on if something looks wrong. For businesses that want that monitoring done for them rather than checked manually, the Care Basic plan adds ongoing uptime and security monitoring on top of hosting, alongside a monthly health-check email. If you're still finding your way around the control panel itself, our plain-language guide to what cPanel actually lets you do is a good place to start.

Key terms used in this guide

• Credential stuffing: an automated attack that tries username-and-password pairs leaked from one site against logins on others.
• Two-factor authentication (2FA): a login that needs a password plus a second proof, usually a time-based code from a phone app.
• Authenticator app: a phone app that generates the six-digit codes used for 2FA.
• Backup codes: one-time codes issued when 2FA is set up, for logging in if the phone is lost.
• Password manager: software that generates and stores a unique password for every account.
• FTP and SFTP: ways of transferring files to and from the server; SFTP is the encrypted version.
• Cron job: a scheduled task that runs on the server at set times.
• Email forwarder: a rule that sends copies of incoming mail to another address.
• API token: a long-lived key that lets software access the account without a password.
• Login history: cPanel's record of recent logins with date, time and IP address.