How to set up Two-Factor Authentication for VPS and Dedicated Servers

Two-Factor Authentication (2FA) is a security measure available to users with Root access on their server. After you enter your password, you must also enter a security code from a connected smartphone in order to log in.

Note that this feature is only available on VPS and Dedicated Server plans that allow you Root access. Managed VPS plans can get Root access by following this guide, but this feature is not recommended for use on a Managed server. This feature is unfortunately not available on our Shared and Reseller plans.
Since 2FA does not allow access from anyone without the security code, our technical support team will not be able to assist you as efficiently. If you lose access to your account, please submit a support ticket and we will try to get it back for you, but please be aware this will not be possible in all cases.

Make 2FA available through WHM

Step 1 - Log into WHM as the Root user and click on Two-Factor Authentication.





Step 2 - Toggle the Security Policy button to On, then click Save.

Enable 2FA

Enable 2FA capabilities for a cPanel account through WHM

Step 1 - Edit a feature list that you use for your accounts (Create a new one if you wish), and ensure it has the option Two-Factor Authentication enabled.





Step 2 - Edit a package that you use for your accounts (Create a new one if you only want to grant 2FA to certain cPanel accounts), and ensure it is using the Feature List from the previous step. This will grant all accounts using this package the ability to set up 2FA.

Set up 2FA inside a cPanel account

Step 1 - Log into the cPanel account you want to enable 2FA for. Click on Two-Factor Authentication.





Step 2 - Click on Set Up Two-Factor Authentication.





Step 3 - On a compatible app, either scan the QR code, or manually enter the details on this page. Enter in the 6 digit code that will display on the phone into the Security Code box and click Configure Two-Factor Authentication.



Note: The 2FA app generates a new six-digit security code every 30 seconds. You will need to enter the security code within 30 seconds. After 30 seconds the code expires and you will need to use the new six-digit code.



Step 4 - Your phone app should now be linked to your cPanel account, and you will not be able to log into your cPanel account without also entering the current 6 digit code from the app. Please note that any developers or any of our support staff will now need to contact you for access if they need to make any changes on the account.

Set up 2FA for WHM

Step 1 - Log into WHM as the user that you want to set up 2FA for. If this is not the root user, you will need to follow the steps in the Enable 2FA capabilities for a cPanel account through WHM section first. Click on Two-Factor Authentication.





Step 2 - Select Manage My Account then Set Up Two-Factor Authentication.





Step 3 - On a compatible app, either scan the QR code, or manually enter the details on this page. Enter in the 6 digit code that will display on the phone into the Security Code box and click Configure Two-Factor Authentication.



Note: The 2FA app generates a new six-digit security code every 30 seconds. You will need to enter the security code within 30 seconds. After 30 seconds the code expires and you will need to use the new six-digit code.



Step 4 - Your phone app should now be linked to your cPanel account, and you will not be able to log into your cPanel account without also entering the current 6 digit code from the app. Please note that any developers or any of our support staff will now need to contact you for access if they need to make any changes on the account.

Disable 2FA

Disable 2FA through cPanel

Step 1 - Log into cPanel (You will need to use your second factor to do so). Click on Two-Factor Authentication.




Step 2 - Select Remove Two-Factor Authentication.




Step 3 - Select Remove.

Disable 2FA through WHM

As a reseller, you may need to disable or reconfigure 2FA for a client that lost access to their account. You will still be able to access their cPanel account through the List Accounts section in WHM, and will be able to manage their 2FA status while logged in as Root.

Step 1 - Log into WHM as the Root user and click on Two-Factor Authentication.




Step 2 - Select Manage Users then Disable.




Step 3 - Select Continue.

For more information, please see the official cPanel documentation.