Losing access to your cpanel" class="auto-link">wordpress-missing-a-temporary-folder-upload-error" class="auto-link">cPanel account is more common than you'd think — a saved password that stopped autofilling after a browser update, a new laptop, or an old employee who set it up and never shared it. The good news: unlike a lost 2FA device or a cPHulk lockout, a plain forgotten password has a couple of straightforward recovery paths, and none of them require rebuilding anything.
Symptom
You go to https://yourdomain.com:2083 (or https://server-hostname:2083) and hit the login screen, but every password you try comes back "Login Attempt Failed." You're not locked out by cPHulk (no "temporarily blocked" banner), and you're not being asked for a 2FA code — cPanel just isn't accepting the password.
There are really three different situations that get lumped together as "forgot my cPanel password," and the fix depends on which one you're in:
- You're the hosting account owner and still have access to the contact email on file.
- You're the account owner but the contact email is also inaccessible (old employee's inbox, defunct domain email).
- You're a reseller or have WHM/root access and just need to reset a cPanel user's password.
Cause
cPanel doesn't store your password in a recoverable form — it's hashed, so there's no "show my password" option anywhere, in cPanel or in WHM. The only real fix is to set a new password through one of cPanel's built-in recovery mechanisms. Which mechanism you can use depends on what access you still have.
Fix 1: Self-service reset via the "Forgot Password" link
If your hosting account has a contact email configured (most do, by default) and you still control that inbox, this is the fastest route:
- Go to the cPanel login page:
https://yourdomain.com/cpanelorhttps://server-hostname:2083. - Click Reset Password (sometimes shown as a small link under the login form — not all themes surface it the same way).
- Enter your cPanel username (not your email).
- Check the contact email inbox for a reset link. It usually arrives within a minute; check spam if it doesn't.
- Follow the link, set a new password, and log in immediately to confirm it took.
If you don't see a "Reset Password" link at all, your account's theme or WHM-level setting may have it disabled. Skip to Fix 2.
Fix 2: No access to the contact email — go through SkyServer support
If the email on file is gone (an ex-employee's mailbox, a domain you no longer control the inbox for), the self-service flow can't verify you. At that point cPanel's automated recovery is a dead end by design — it won't reset a password based on "trust me."
Open a ticket with SkyServer support and be ready with:
- Your domain name and cPanel username.
- Proof of ownership — the invoice/order ID, or access to the billing account tied to the hosting package.
Support will verify ownership and either reset the password directly or update the contact email so the self-service flow works again. This is intentionally a manual step — it's the same identity check that stops an attacker from resetting your password by claiming to have lost access to your inbox.
Fix 3: You have WHM/root access — reset it yourself
If you're a reseller, or you manage the server (root/WHM access) and just need to reset a cPanel account's password without touching the contact email flow at all:
- Log in to WHM as root or reseller.
- Go to List Accounts and find the cPanel username.
- Click the little person/edit icon next to the account, or search for Password Modification in the WHM search bar.
- Enter and confirm the new password (WHM will grade its strength — use something it accepts on the first try, ideally a randomly generated 16+ character password from a manager).
- Click Change Password.
This works even if the account's contact email bounces, and it doesn't require the account owner to do anything on their end. If you're doing this for a client, tell them before you do it — a silent password change looks identical to a compromise from their side.
Command-line alternative (root SSH access)
If WHM's UI is unreachable for some reason but SSH still works, you can reset a cPanel password directly from the shell as root:
whmapi1 passwd user=cpanelusername password='NewStrongPassword123!'Check the JSON output for "result": 1 to confirm it succeeded. This is the same call WHM's UI makes under the hood, so it respects the server's password strength policy — a password that's too weak will be rejected with a clear error rather than silently failing.
What to do if none of this works
A few edge cases that block all three fixes above:
| Situation | What's actually happening | Fix |
|---|---|---|
| Reset email never arrives | Contact email is wrong, or mail is being filtered server-side | Check Email > Forwarders and the contact email in cPanel > Contact Information (if you can still log in at all); otherwise go through support |
| WHM won't accept any new password | Password policy plugin (e.g. minimum strength requirement) rejecting weak strings | Use a generated password with mixed case, numbers, symbols, 16+ characters |
| "Reset Password" link is missing entirely | Disabled at the WHM > Tweak Settings level, or a custom cPanel theme without it | Use Fix 3 (WHM reset) or contact support |
| Account shows suspended, not just a bad password | Different problem — billing or resource-limit suspension, not a password issue | Check the suspension reason in WHM or ask support; a password reset won't fix a suspended account |
Prevention
- Keep the contact email current. When staff change, update cPanel > Contact Information before the old inbox disappears — this is the single biggest reason self-service resets fail.
- Use a password manager instead of memorizing or reusing passwords, so "forgot my password" stops being a recurring event.
- Enable 2FA once your password situation is sorted (Security > Two-Factor Authentication in cPanel) — it protects the account without making password resets any harder, since 2FA and password reset are handled separately.
- Store WHM/root credentials somewhere the whole team can reach if you're the one managing the server, so a single person leaving doesn't lock everyone out of Fix 3 as well.
Frequently Asked Questions
Can SkyServer just tell me my old cPanel password?
No — cPanel stores passwords as hashes, not plain text, so nobody (including support) can retrieve or read your existing password. Every recovery path sets a brand-new password instead.
Is this the same as being locked out by cPHulk?
No. A cPHulk lockout happens after too many failed login attempts and shows a "temporarily blocked" message with a countdown or IP-based block — the password itself might be correct. A forgotten password just gets rejected as invalid, with no lockout banner. If you see a lockout message, that's a different fix (waiting it out, or whitelisting your IP in WHM's cPHulk settings).
Will resetting my cPanel password break my email accounts or FTP logins?
No. Your cPanel login password is separate from individual email account passwords and FTP account passwords — those are set independently under Email Accounts and FTP Accounts. Resetting the main cPanel login doesn't touch them.
What if I'm on a reseller plan and lost my WHM password too?
Reseller WHM passwords follow the same rules as cPanel — no plain-text recovery. If you still have WHM access to another admin account, reset it from there. If not, this needs SkyServer support to verify ownership at the reseller level.
How strong does the new password actually need to be?
WHM's built-in strength meter typically requires a score of 65+ (roughly: 12+ characters mixing upper/lowercase, numbers, and symbols) before it'll accept a change. A randomly generated password from a manager clears this easily and avoids the back-and-forth of guessing what the policy will accept.
