A server-wide password policy ensures every account meets a security baseline. Learn how to enforce strong password requirements in WHM.
Why Individual Vigilance Isn’t Enough
Even if you personally use strong passwords, every additional user account — email, FTP, or cPanel sub-users — represents a potential weak link if left to individual discretion. A server-wide password policy removes the guesswork and enforces a consistent security baseline for everyone.
What a Strong Password Policy Includes
- Minimum password length (commonly 12–16 characters)
- Required mix of character types (uppercase, lowercase, numbers, symbols)
- Rejection of passwords found in common breach databases
- Prevention of passwords that closely match the username or domain name
How to Configure Password Strength Requirements in WHM
- Log in to WHM and navigate to Server Configuration > Password Strength Configuration.
- Set the minimum required password strength score for each account type (cPanel, FTP, email, MySQL).
- Increase the threshold to enforce genuinely strong passwords rather than relying on the default setting.
- Save your changes so the new policy applies to any password created or changed going forward.
Applying the Policy Retroactively
Since policy changes typically apply only to new or changed passwords, schedule a review requiring all existing account holders to update their passwords to meet the new standard.
Supporting the Policy With Tools
- Recommend or provide a password manager to make compliance easy for your team or clients.
- Combine password policy enforcement with mandatory 2FA for maximum effect.
- Communicate the reasoning behind the policy so users understand it’s a protective measure, not an inconvenience.
A well-enforced password policy ensures your server’s security doesn’t depend on the weakest password anyone happens to choose.