The cPanel message The login is invalid does not always mean the password is wrong. cPHulk intentionally displays the same message when it blocks an account or IP address, and a browser can submit valid credentials to an old server after a DNS change.
Troubleshoot from the outside in. First confirm the login URL and browser session, then verify the server receiving the request, and only then change account or security settings.
Confirm the correct login interface
Use the encrypted port for the interface you intend to access:
- cPanel account:
https://server-hostname:2083 - WHM administration:
https://server-hostname:2087 - Webmail:
https://server-hostname:2096
A cPanel username will not authenticate to WHM as a server administrator. Email accounts normally sign in through Webmail with the full email address, not the cPanel account username.
Use the server hostname supplied by the administrator. Logging in through a website hostname can reach a proxy, CDN or old server instead of the current cPanel service.
Rule out a stale browser session
Open a private browsing window and enter the direct hostname and port. If that works, clear cookies and site data for the old login hostname.
This is particularly relevant when WHM's “Log in to cPanel” action fails but a direct login works. cPanel's current support guidance identifies browser cache as a common cause of this specific behavior.
Do not disable security software or TLS verification to test a login. A certificate warning or connection failure is a separate issue from an authentication rejection.
Verify that DNS reaches the expected server
After a migration, compare the hostname or domain's resolved address with the destination shown in the server logs:
dig +short server.example.netTry the server's canonical hostname directly. If one URL works and another rejects the same credentials, the failing name may still point to the previous server, a proxy or a different cPanel node.
Allow for resolver caching, but verify rather than assuming propagation is the cause. Check both IPv4 and IPv6 when the hostname publishes both.
Check whether cPHulk blocked the login
cPHulk Brute Force Protection does not identify itself on the login page. When it blocks an IP address or account, cPanel can still display The login is invalid.
If you retain SSH access through a trusted key or can use WHM from another approved network, review:
WHM > Security Center > cPHulk Brute Force Protection > History Reports
Remove only the verified administrator address from the block list. From the command line as root, cPanel documents this API call:
whmapi1 flush_cphulk_login_history_for_ips ip=203.0.113.10Replace the documentation address with the actual trusted client IP. Do not clear all cPHulk history or disable brute-force protection merely to solve one login. Add stable administrative addresses to the whitelist only when that is operationally appropriate.
See cPanel's cPHulk documentation for current block behavior and controls.
Check the server firewall separately
cPHulk and the network firewall are different layers. If the connection times out rather than returning an invalid-login page, check the provider firewall and the server firewall for ports 2083 and 2087.
On servers with CSF installed, an administrator can search its rules for the client address:
csf -g 203.0.113.10Remove a block only after confirming that the address is trusted and the failed attempts were legitimate. Do not disable the entire firewall for a login test.
Read cPanel's login logs
The login interface deliberately gives the user limited information, but the server log is more specific. cPanel records login attempts in:
/usr/local/cpanel/logs/login_logSession activity is recorded in:
/usr/local/cpanel/logs/session_logLook at entries for the exact time, username and client IP. The log can separate an incorrect password, a blocked request and a request arriving for a different account. cPanel maintains the current locations in its log-file reference.
Avoid posting complete log lines publicly. They may contain usernames, addresses and session-related information.
Confirm the account and reset the password safely
In WHM, use Account Information > List Accounts to confirm the exact cPanel username and server. Then use Account Functions > Password Modification to set a new strong password.
Do not place a plaintext password in a shell command where it can remain in shell history or process output. After resetting it, test once in a private window against the direct hostname.
If a hosting migration changed the username, the old account name will continue to fail even when the password text is correct. Verify the account identity rather than repeatedly resetting the wrong record.
Check account state and cPanel service health
Confirm that the account is not suspended and that the cPanel service is running. On a server where all cPanel and WHM logins fail, check the service through the supported wrapper:
/usr/local/cpanel/scripts/restartsrv_cpsrvd --statusReview service output and cPanel logs before restarting it. A server-wide time, filesystem or certificate problem can affect sessions for every user, while a single-user failure usually points to the account, browser or security history.
Check system time when session tokens expire immediately:
timedatectl statusCorrect the time synchronization service rather than setting the clock repeatedly by hand.
When to treat the event as a security incident
Investigate further when the logs show successful sessions you do not recognize, repeated attempts from many addresses, an unexplained password change, a new administrator or API token, or changes made immediately after login.
In that case:
- Preserve the cPanel, SSH and firewall logs.
- Restrict administrative access from a trusted path.
- Rotate affected credentials and API tokens from a clean device.
- Review account, package, cron and file changes.
- Determine whether the entry point was cPanel, email, SSH or an application before declaring the server clean.
Our cPanel server management service handles authentication failures, migrations and service issues. If the evidence indicates unauthorized access, use a structured server security investigation rather than only resetting the password.
Need experienced cPanel and WHM support?
Our engineers manage cPanel servers, troubleshoot service failures and keep hosting systems secure and responsive.
