When changing phones, reconfigure cPanel 2FA so the new authenticator can generate valid codes. Removing 2FA entirely returns that panel login to password-only access, so use removal only for a deliberate recovery or policy change.
IN THIS ARTICLE
01 Prepare for the change
Keep access to the current authenticator until the replacement is tested. Use a trusted device and protect the new setup key. If you cannot sign in at all, contact support through the verified account-recovery process.
02 Replace or remove cPanel two-factor authentication
- Open Two-Factor Authentication in cPanel. To replace the authenticator, choose Reconfigure rather than leaving the account permanently unprotected.
- Link the new app with the displayed QR code or secret and confirm a current code. Reconfiguration replaces the previous setup, so older app entries will no longer generate valid codes.
- Test a fresh login with the new app. Current versions can log out other cPanel windows when the configuration changes.
- If you intentionally need to remove 2FA, use Remove Two-Factor Authentication and review the resulting login protection.
- Re-enable 2FA promptly after a temporary recovery, and remove obsolete authenticator entries only once the working replacement is confirmed.
03 Confirm the expected result
The new authenticator should work on a fresh login, and the retired configuration should fail. For intentional removal, verify the account’s documented security requirements still permit password-only access.
04 Example: replace an authenticator before retiring the old device
Keep a working authorised session and the old authentication method available while you prepare the replacement. Review the current cPanel recovery process and account authority requirements before changing the setting.
Use the supported two-factor controls to replace or re-enrol the authenticator. Complete the confirmation step, then test a fresh login from another browser session. Do not close your only working session until you know the replacement works.
What should I do if the old phone is already lost?
Contact us through your established account recovery route. We must verify that you are authorised before assisting with an authentication reset. Do not share recovery secrets, current one-time codes or your main password in an ordinary support message.
If the phone was stolen, review other account sessions and credentials it could access as part of your security response. Removing cPanel two-factor authentication does not secure a separately compromised mailbox or password manager. Re-enable an appropriate second factor after recovery rather than leaving the account with reduced protection indefinitely.
Will resetting my password replace a missing second factor?
Do not repeatedly reset the password to solve a missing second factor. Support may need identity verification before disabling it. Changing cPanel 2FA does not automatically remove client-area or mailbox 2FA, so identify which login screen is actually blocking access.