You set up two-factor authentication on your cPanel or WHM account like a responsible admin. Then you got a new phone, or the authenticator app got wiped during a factory reset, or you simply lost the device the codes were coming from. Now you're staring at a login screen asking for a six-digit code you have no way to generate, and your password alone isn't enough to get in. Here's how to get back into your account without waiting days on a support ticket, and how to set things up so it never happens again.
Symptom
You enter your cPanel or WHM username and password correctly, but instead of landing on your dashboard you're prompted for a "Security Code" or "Two-Factor Authentication" token. The device that used to generate that code — Google Authenticator, Authy, or similar — is gone, reset, or on a phone you no longer have. Retrying the password doesn't help; the 2FA prompt appears every time, and there's no obvious "skip" or "forgot device" link on that screen.
Why This Happens
cPanel's 2FA implementation ties your account to a TOTP (time-based one-time password) secret that was generated once, when you first scanned the QR code into your authenticator app. That secret lives in two places: cPanel's database, and your phone's app. If the phone side disappears — lost device, app reinstalled, factory reset, switched to a new phone without migrating accounts — there's no way to regenerate matching codes. cPanel has no email-based "forgot your code" flow by design, because that would defeat the purpose of two-factor security. Recovery has to go through an account with higher privileges: WHM (for a cPanel user) or root/SSH access (for a WHM/root user). Most people hit this in one of three ways:
- Upgraded phones and didn't move the authenticator entries over before wiping the old one
- Reinstalled the authenticator app itself (this deletes all stored secrets locally — they aren't backed up to the cloud by default on most apps)
- Reset a device to factory settings without exporting 2FA accounts first
Fix 1: Reseller or Root User Can Reset It From WHM
If you're a cPanel account holder and someone else on your team has WHM/root access, this is the fastest path — usually under two minutes.
- Log in to WHM as root or a reseller with the right ACLs
- Go to Home → Security Center → Manage Two-Factor Authentication
- Search for the affected cPanel username under Remove Two-Factor Authentication
- Click Remove next to that account
The user can now log in to cPanel with just their password. From there, go straight to Security → Two-Factor Authentication in cPanel and set it up again with the new device — don't leave the account without 2FA for long.
Fix 2: You're the Root/WHM User Yourself, With SSH Access
If it's your root WHM login that's locked, and you have SSH access to the server (VPS or dedicated), you can clear 2FA directly from the command line:
whmapi1 twofactorauth_remove_configuration user=youraccountusernameReplace youraccountusername with the actual cPanel/WHM username, including root if that's the account that's locked. Run this as root over SSH. Once it completes, log in to WHM/cPanel with your password only, then re-enroll 2FA immediately with your new device.
If you'd rather go through the database directly (only do this if whmapi1 isn't available for some reason), the 2FA config is stored per-user under /var/cpanel/authn/twofactor_auth/state/. Removing the relevant user's config file there and restarting cpanel service has the same effect, but the API command above is safer and does the cleanup properly.
Fix 3: No SSH Access, No Reseller — Contact Hosting Support
If your VPS or shared hosting account only has one login and that login is now locked, you'll need your hosting provider to reset it from their end. On SkyServer, open a support ticket from the client area (not from cPanel, since you can't log in) and include:
- Your domain name and cPanel/WHM username
- Proof of account ownership (billing details, last invoice, or the registered email on file)
- A note that you've lost your 2FA device — support can verify identity and clear the 2FA flag server-side
This is the slowest option since it depends on a human verifying you're really the account owner, but it's there specifically for this situation.
Prevention: Set This Up Once, Never Get Locked Out Again
The fix above works, but it's a hassle you can skip entirely with a bit of setup now:
| Step | What to do |
|---|---|
| Save backup codes | When cPanel first shows you the 2FA QR code, it also offers backup/recovery codes. Save these somewhere durable — a password manager entry, not a screenshot on the same phone |
| Register two devices | Scan the same QR code into a second authenticator app (e.g., your phone and a desktop app like Authy or a password manager's built-in TOTP field) at setup time |
| Use a syncing authenticator | Apps like Authy, Bitwarden, or 1Password sync 2FA secrets across devices and to the cloud, so a single lost phone doesn't wipe your only copy |
| Keep a reseller/root fallback | If you manage multiple cPanel accounts, make sure at least one WHM-level admin can always reach Security Center to reset 2FA for others |
| Document recovery access | Keep your hosting provider's support contact and account-verification details somewhere you can reach even if you're locked out of everything else |
If you manage 2FA for a team, treat "who can reset another user's 2FA" as part of your onboarding checklist, not an afterthought you figure out during an outage.
Frequently Asked Questions
Can I disable 2FA from the cPanel login screen without a code?
No. cPanel doesn't offer an email or SMS fallback at the login screen — that's intentional, since it would create a bypass for the exact protection 2FA provides. Recovery always has to go through a higher-privilege account (WHM/root) or your hosting provider's support team.
Will removing 2FA delete my website or account data?
No. Removing the 2FA configuration only clears the authentication requirement — it doesn't touch your files, databases, email accounts, or DNS records. It's purely a login setting.
I have SSH access but I'm not sure if my user is root — can I still run the whmapi1 command?
You need root privileges to run whmapi1 twofactorauth_remove_configuration, since it's modifying another account's security config. If you only have shell access as a non-root user, use sudo if it's configured, or ask whoever has root to run it for you.
Can I use the same authenticator app entry across multiple cPanel accounts?
Each cPanel/WHM account generates its own unique TOTP secret when you enable 2FA, so you'll have a separate entry per account in your authenticator app — that's expected and fine. Just label them clearly (e.g., "SkyServer - example.com") so you don't mix them up.
How long does it take SkyServer support to reset 2FA if I have no other access?
Once you submit a ticket with ownership verification, it's typically handled within one support cycle — usually well under a day for standard tickets. Response time depends on how quickly your identity can be confirmed, so submitting complete billing/ownership details upfront speeds things up considerably.
