cPanel & WHM Security Update

Stronger two-factor authentication for API requests We’ve added a Security Policy that closes a gap in API authentication: when it’s enabled alongside two-factor authentication (2FA), API requests can no longer skip 2FA protection. Once you turn on both settings, the system handles inbound API requests a…

cPanel & WHM Security Update

2026 July 14

Stronger two-factor authentication for API requests

We’ve added a Security Policy that closes a gap in API authentication: when it’s enabled alongside two-factor authentication (2FA), API requests can no longer skip 2FA protection. Once you turn on both settings, the system handles inbound API requests as follows:

• Session-authenticated requests (from a logged-in cPanel or WHM browser session) require 2FA before the API can be used.
• HTTP Basic authentication requests are denied.
• API token requests are unchanged and continue to work as expected. API tokens remain the supported method for unattended, automated API access.

New installations enable this policy by default. Existing servers are not affected automatically – if 2FA is already enabled on your server but this policy isn’t, a Feature Showcase entry (Apply Security Policies to API requests) and a Security Advisor warning will prompt you to turn it on. You can enable or disable the policy at any time in WHM’s Configure Security Policies interface.

For a full list of changes, visit the cPanel & WHM change logs and select your version.

sudo /scripts/upcp --force