Skip to content

Changing your cPanel password

Every cPanel hosting account has one password of its own, separate from the password you use to sign in to CloudPress. You set it from the cPanel Accounts list in your workspace: open the account's actions menu, choose Change password, type the new password twice, and confirm your identity.

CloudPress never shows you the account's current password — the Login details dialog prints connection settings only — so a forgotten cPanel password is replaced here rather than looked up.

Before you start

  • Your workspace needs cPanel hosting enabled. It is switched on per workspace; if yours isn't enabled, the cPanel Accounts item never appears in the sidebar and opening a cPanel URL directly returns you to the dashboard with "cPanel hosting is not available for this workspace." See cPanel hosting on CloudPress.
  • The workspace needs a paid plan. On a trial, cPanel pages redirect with "Activate a paid plan to use cPanel hosting."
  • You need permission to manage billing on the workspace that owns the account. Without it the change is refused with "You do not have permission to manage billing for this account." — see Inviting users and roles.
  • Be ready to confirm your identity. Submitting the form triggers the re-confirm identity step described below.

What this password covers

Used for How
The cPanel control panel Signing in at the control panel address for the account, with the account's username. The dialog you fill in is headed Change password and reads "Set a new cPanel password for …" followed by that username.
FTP and SFTP The Login details dialog lists the FTP / SFTP host and username, and gives the password as "Use your cPanel password" — this one.

Two things it does not cover:

  • Mailbox passwords. Each email account on the hosting package has its own password, which Login details points you to reset "in cPanel under Email accounts". Changing the account password leaves those untouched.
  • Database users. CloudPress asks the hosting server to change the account password only; it does not ask it to update database logins to match, so database users you created inside cPanel keep the passwords you gave them.

You don't need this password to reach cPanel from the dashboard

The Log in button on the accounts list has the hosting server mint a one-time control-panel session for the account — no password is sent, and none is asked for. It keeps working exactly the same before and after a password change. See Logging in to cPanel.

Change the password

  1. Open the accounts list. In the workspace sidebar, choose cPanel Accounts. The page is headed cPanel accounts.

  2. Open the account's actions menu. At the end of the account's row, next to Log in, is a three-dot button labelled Account actions. Choose Change password from it.

  3. Enter the new password twice. The dialog is headed Change password and has a New password field and a Confirm password field. Both are required, and each has an eye icon that reveals what you have typed. If the two don't match, the confirm field reports "Passwords do not match" before the form will submit.

  4. Submit. Choose Change password in the dialog footer. Cancel closes it without changing anything.

  5. Confirm your identity with your passkey or password, if you haven't recently. This is the platform's re-confirm identity ("sudo") step, and the password change is one of the actions gated behind it. What you typed in the dialog is carried through the challenge, so you don't retype it — once you have confirmed, the change is submitted for you.

  6. Read the confirmation. You land back on the accounts list. On success the message is "Password changed for …" with the account's username. On failure it is "Could not change password: …" followed by the reason the hosting server gave.

If the change is rejected

CloudPress itself checks only two things before sending the change on: that you entered a password at all ("Please enter a new password.") and that the two fields match ("The passwords do not match.").

Everything else — how long the password must be, which characters it needs — is judged by the hosting server, not by CloudPress, and its verdict comes back in the "Could not change password: …" message on the accounts list. If you see that message, read the reason it carries and try again with a stronger password. Nothing has changed on the account when it appears.

After you change it

Anything that had the old password stored signs in with the new one from now on: FTP and SFTP clients, deployment scripts, backup tools and anything else that connects with the account's username. Update them, or their next connection attempt fails.

The dashboard is unaffected: your CloudPress sign-in is a different password entirely, and the Log in button doesn't use the cPanel password at all.

When Change password isn't in the menu

The actions menu only appears on accounts that are running normally.

  • The account is suspended. A suspended account shows "Account suspended. Contact support to resolve." in place of its buttons — there is no actions menu, so the password can't be changed until the suspension is lifted.
  • The account is scheduled for deletion. Its row offers Restore and Purge now instead. Restore it first — see Deleting and recovering an account.
  • The account is still provisioning. A row that reads Provisioning… isn't ready on the server yet; wait for it to finish.

Mail-only accounts — the ones labelled MailXXL — do keep the Change password action, even though their plan changes go through support.

Changing it over the API

An integration can do this too, with PATCH /api/cpanel_accounts/{username}/password. It applies the new password to the hosting account straight away — there is no asynchronous window, so the old password stops working as soon as the call comes back.

Two differences from the dialog above are worth knowing:

  • There is no confirmation field. Typing the password twice is a form affordance; the API takes the value once.
  • The identity re-confirm step is replaced, not skipped. An API credential has no way to prove someone is at the keyboard right now, so the API asks for something else instead: the same manage billing permission on the workspace that owns the account, plus an API key or a signed-in session belonging to a real user. An OAuth access token is refused whatever scopes it carries, and so is a system API key that isn't tied to a user.

The hosting server judges the password's strength either way, so a value it considers too weak is rejected there rather than by CloudPress — the same verdict you'd see in the dashboard, returned in the response instead. And an account scheduled for deletion is locked here as well: the API refuses the change until the account is restored, just as the dashboard hides the menu item.

Rotating the password may not close open sessions

Whether cPanel ends sessions already open under the old password is cPanel's business, and CloudPress doesn't establish it either way. If you are changing the password because it leaked, don't assume the change alone shut out whoever had it.

Next steps