cPanel two-factor authentication adds a time-based code to the panel login after the password. It protects that login flow; our client area, mailbox logins and API integrations have their own authentication settings.
IN THIS ARTICLE
Check access and requirements
Install a trusted authenticator app and enable automatic time on the device. Plan a secure recovery method appropriate to the app and account. Treat the setup key or QR code as a secret because it can generate future codes.
01 Enable two-factor authentication for a cPanel login
- Open Two-Factor Authentication in cPanel and select Set Up Two-Factor Authentication.
- Scan the QR code in the authenticator app or enter the displayed account and key manually. Label the entry clearly with the correct server and account.
- Enter the current six-digit code before it expires and choose Configure Two-Factor Authentication.
- Test a fresh login with the password and newly generated code. Current versions may sign out other panel windows when 2FA is configured or reconfigured.
- Store recovery information securely and review integration authentication separately. API tokens should be controlled independently; enabling browser 2FA does not automatically change every API policy.
Confirm the intended access works
A fresh cPanel password login should request and accept the authenticator code. Confirm you selected the correct app entry if you manage several hosting accounts.
Why are my cPanel authenticator codes rejected?
If codes fail, check device time and ask support to check server time where necessary. If the feature is absent, the provider may need to enable it. If the authenticator is lost, use the verified account-recovery process rather than sharing the password and setup key with someone else.