Use an approved TOTP authenticator and accurate device time. Confirm access to the server’s emergency console or another authorised recovery process. Keep the setup secret out of screenshots and ordinary support messages.

1. As an authorised administrator, open Two-Factor Authentication in WHM and enable the server policy if it is not already enabled.
2. Use Manage My Account to begin setup for the current root or eligible reseller identity.
3. Scan the displayed QR code or enter the provided account and key into the authenticator. Store any approved recovery material securely.
4. Enter the current six-digit code and complete configuration before it expires.
5. Test a fresh login with the password and code while keeping a recovery route available. Review other administrator identities separately and document ownership of each enrolment.

The intended interactive login should require the time-based code. Reconfiguring an account creates a new setup and invalidates codes from the old enrolment.

If valid-looking codes fail, check server and device clocks before repeatedly retrying. Lost-device recovery requires the authorised administrator process. API password-authentication policies and token authentication need separate review; enabling browser 2FA does not automatically secure every integration path.

No. The policy makes the feature available, while user enrolment and any applicable enforcement are separate. Verify the actual account configuration rather than assuming every user has completed setup.

• Rotating a WHM integration token with minimal interruption
• Reviewing cPHulk login blocks without weakening global protection
• Planning key-based administrator access before disabling SSH passwords
• Enabling or disabling cPanel features through WHM

• cPanel: Two Factor Authentication For Whm
• cPanel: Configure Security Policies