Updated: 22 October 2026 · Applies to: cPanel and WHM 130 and later, cPanel shared and reseller hosting
When the cPanel password reset fails, it is almost always one of five things: the Reset Password link is switched off on the server, no contact email address is saved, the security code goes to an old address, the reset was finished in a different browser, or brute force protection is still blocking your logins. The method that avoids all of them is the client area: How to Reset Your cPanel Password from the Ucartz Client Area sets a new password without any email or code.
This article is for a reset that does not work. For the normal steps on the cPanel login page, see Forgot cPanel Password: Use the Reset Password Link at Login. Find your symptom below.
There is no Reset Password link on the login page
The link appears only when the server administrator has Reset Password for cPanel accounts switched on in WHM (Server Configuration › Tweak Settings, System tab), according to cPanel. It is on by default but can be turned off (Disable Reset Password option shows where).
- Ucartz shared or reseller hosting: use the client area method in How to Reset Your cPanel Password from the Ucartz Client Area.
- Your own VPS or dedicated server with WHM: switch the setting back on as root, or reset the account password directly in WHM or on the command line (How To Change/reset/update cPanel password from command line?).
The reset page shows an email address you do not recognise
According to cPanel, when an account has no contact email address saved, the reset page shows a made-up address to protect the account. No code can reach you there. Use the client area instead, and once you are back in cPanel, save a real address under Preferences › Contact Information (How to Edit Contact Information and Preferences in cPanel?).
The security code email does not arrive
- Check the spam or junk folder of the contact address, then click Send Security Code Again.
- Make sure you typed the contact address exactly as it is saved in cPanel. The code is only sent to that address, not to the email you use for the Ucartz client area.
- If the contact address is an old one you no longer use, the code cannot reach you. Use the client area method and then update the contact address.
- If the contact address is a mailbox on the same hosting account (for example
info@example.comonexample.com), a full mailbox or a mail problem on that account also stops the reset email. cPanel recommends a contact address outside the account for this reason. You can still read that mailbox in webmail, because email accounts have their own passwords.
The security code is not accepted
cPanel requires you to finish the reset in the same browser session in which you requested the code. Opening the email link in another browser, a private window or another device starts a different session. Go back to the original tab and type the code there, or start again and request a new code. Use the newest code if you clicked Send Security Code Again.
The new password is refused
The server sets a minimum password strength (in WHM this is Security Center › Password Strength Configuration, according to cPanel). Choose a longer password, 16 characters or more, that mixes upper and lower case letters, numbers and symbols, and avoid your domain name, username and dictionary words. A password manager can create one for you.
Login still says "The login is invalid" after the reset
- Wrong username: cPanel logins use the cPanel username from your welcome email, not the domain or an email address.
- Saved old password: your browser or password manager may still fill in the old one. Type the new password by hand.
- Brute force block: if the server runs cPHulk, it blocks an IP address after repeated failed logins, and according to cPanel the login page then shows the same "The login is invalid" message as a wrong password. Several tries with the old password can trigger it. Stop trying, wait a while, then log in once with the new password. If you are still blocked, open a ticket with your IP address; on your own server, an administrator can clear the block in WHM under cPHulk Brute Force Protection.
- Suspended service: a suspended hosting account cannot log in at all. Pay any overdue invoice under Billing › My Invoices in the client area, or open a ticket.
The password from the welcome email does not work
The welcome email shows the password that was set when the account was created. If it was changed since then (by you, a developer or a reset), the old one no longer works. Also check that you copied it without a space at the start or end, and that you are using it on the cPanel login page, not the client area login. The client area method sets a fresh password in one step.
Still stuck
Open a support ticket with your domain name and what you see on screen. We verify that the account is yours and set a new password for you. Reseller customers who manage their own clients can reset those passwords themselves: WHM Reseller Password Reset: Your Login and Client Accounts. A VPS root password that is refused after a reset has its own guide: New VPS Root Password Not Accepted After a Virtualizor Reset.
Official documentation: How to Reset a cPanel Account Password and cPHulk Brute Force Protection (cPanel).
