Two-factor authentication (2FA) adds a second step when you log in to cPanel directly. As well as your password, you enter a six-digit code from an app on your phone. Even if someone finds out your password, they can't get in without your phone.
Before you start
Install an authenticator app on your phone. Any of these work:
- Google Authenticator
- Microsoft Authenticator
- Authy
- A password manager with authenticator codes built in, such as 1Password or Bitwarden
Set up 2FA
- Log in to cPanel from your service page under Services → My Services (https://www.hooplahosting.co.nz/client/clientarea.php?action=services).
- Open Two-Factor Authentication (type it in the cPanel search bar, or find it under Security).
- Click Set Up Two-Factor Authentication.
- Open your authenticator app, add a new account, and scan the QR code on the screen. If you can't scan it, enter the Account and Key shown under the code instead.
- Type the six-digit code from your app into Security Code and click Configure Two-Factor Authentication.
You'll see a confirmation message. From now on, logging in to cPanel directly (for example at yourdomain.co.nz/cpanel) asks for a code from your app after your password.
Keep a copy of the key somewhere safe, such as your password manager. If you lose or replace your phone, you can use it to add cPanel to the new phone's authenticator app.
Protect your client area too
Anyone who can log in to your Hoopla Hosting client area can manage your services and open cPanel from there, so turn on 2FA for your client area as well. Log in to the client area, click your name at the top right, choose Security Settings, and follow the steps under Two-Factor Authentication.
Turn off 2FA or move it to a new phone
- In cPanel, open Two-Factor Authentication.
- Click Remove Two-Factor Authentication to turn it off, or Reconfigure to scan a new QR code with a new phone.
Do this before you wipe or hand in your old phone.
Troubleshooting
- The code is always rejected: the time on your phone is probably out. Turn on automatic date and time in your phone's settings, then try again. In Google Authenticator on Android, you can also use Settings → Time correction for codes.
- I've lost my phone and can't log in: you can still open cPanel from your client area, then remove or reconfigure 2FA as above. If that doesn't work, open a support ticket from your client area and we'll turn it off for you once we've confirmed it's you.
- My IP address got blocked after failed logins: see Why is my IP address blocked from cPanel, WHM or my website?
Need help?
If you get stuck, open a support ticket and we'll help.
