Step-by-step procedure to setup two factor authentication for cPanel users

Requirements (before you begin)

1. You need a smartphone + 2FA app
   2FA requires a smartphone with a supported time-based one-time password (TOTP) app. Suggested apps:
   

• Google Authenticator (Android, iOS) or
  
• Duo Mobile (Android, iOS)
  

Configure Two-Factor Authentication (step-by-step)

1. Log in to your cPanel account.
   
   
2. Find the 2FA control
   Search for 2FA in the cPanel search bar and click Two-Factor Authentication.
   
   
   
   Setup Two factor Authentication:
   
   
   
   
3. Link your cPanel account to your 2FA app
   

• Automatic (recommended): Scan the displayed QR code with your authenticator app to automatically create the link.
  Manual: If you cannot scan the QR code, in your app choose the manual entry option and enter the provided Account and Key information shown on screen.
  
  
  
  

• Within your 2FA app, copy the current six-digit code.
  
• Note: The 2FA app generates a new six-digit security code every 30 seconds.
  
  
  

• Paste/type the six-digit security code into the Security Code text box in cPanel.
  
• Important: You must enter the security code within 30 seconds — after that time the app will generate a new code.
  
  
  

• Click Configure Two-Factor Authentication.
  
  

• Example error: Failed to set user configuration: The security code is invalid.
  

Remove or reconfigure 2FA

• Remove 2FA:
  Click Remove Two-Factor Authentication in cPanel.
  
• Reconfigure 2FA:
  Click Reconfigure and then follow the same steps listed above to configure two-factor authentication again.
  
  • Warning: Reconfiguring will overwrite your account’s existing 2FA configuration. Any existing 2FA app configurations will no longer provide valid security codes after you reconfigure.
    

Quick troubleshooting checklist

• If codes keep failing:
  
  • Ensure you enter the code within 30 seconds.
    
  • Check the phone’s time is set to automatic network time (authenticator apps rely on correct phone time).
    
    
• If you lose your phone or cannot access your 2FA app:
  
  • Use any alternate recovery or backup methods your host provides (contact support).
    
  • If reconfiguring, remember that reconfiguration overwrites old settings.