Default and previously compromised passwords are an open invitation to attackers. Here’s how to identify and replace them across your cPanel environment.
The Hidden Danger of Default Credentials
Many hosting setups, staging environments, and freshly provisioned servers ship with default usernames and passwords intended only for initial setup. If these are never changed, they become a permanent backdoor — one that’s often documented publicly in hosting provider manuals and easily guessed by attackers.
Why Compromised Passwords Are Just as Dangerous
A password doesn’t need to be “default” to be dangerous. If it has ever appeared in a data breach — even for an unrelated service — it’s likely listed in public credential-stuffing databases that bots test against hosting panels every day.
How to Check and Replace Passwords
- Log in to cPanel and navigate to Preferences > Password & Security.
- Immediately replace any password you didn’t personally generate, including ones set by a developer, agency, or hosting provider during setup.
- Use a breach-checking tool to see if your current password has been exposed, and replace it if so.
- Update passwords for all related accounts: FTP users, database users, and email accounts tied to the domain.
Extending This to WHM
Server administrators should also check the WHM root password and any reseller account passwords created during account provisioning, since these carry elevated privileges across every hosted domain.
Ongoing Practice
- Treat every new account, plugin, or add-on service as a fresh password to secure.
- Schedule periodic password audits, especially after staff or contractor turnover.
- Never share credentials via email or chat; use a secure password manager’s sharing feature instead.
Replacing default and compromised passwords isn’t a one-time chore — it’s an ongoing discipline that closes one of the easiest entry points attackers rely on.