❗ Why cPanel / DirectAdmin Security Is Critical

Your hosting control panel (cPanel or DirectAdmin) is more powerful than your WordPress admin or any website login. From there, an attacker can:

• Delete or modify all your website files
• Access and export your databases
• Reset all your email passwords
• Send spam from your domain and IP
• Change DNS records and redirect your domain
• Install malware or phishing pages

⚠️ If someone hacks your cPanel or DirectAdmin login, they basically own your entire online presence under that hosting account.

That’s why cPanel / DirectAdmin should be treated like your online “bank vault”. You must secure it with strong passwords, 2FA, and good habits.

✔️ Step 1: Use a Strong and Unique Password

Weak passwords are still the number one reason hosting accounts get hacked. A strong password should be:

• At least 12–16 characters
• A mix of uppercase, lowercase, numbers, symbols
• Not based on your name, birthday, phone number or brand name
• Not reused on other websites (Gmail, Facebook, etc.)

Example Strong Passwords

Correct: uM7!pN3#rQ9z&F2
Wrong: nairahost123, password, 123456, admin123

How to Change Your cPanel Password

1. Log in to your Nairahost client area.
2. Go to Services → My Services.
3. Click your hosting plan.
4. Click Change Password or Login to cPanel and use the password change tool inside cPanel.

⚠️ Never share your hosting password in WhatsApp, email, Telegram or SMS. If you MUST share credentials for a developer, create a separate access method or change the password immediately after they finish.

✔️ Step 2: Enable Two-Factor Authentication (2FA)

Two-Factor Authentication (2FA) adds a second layer of security to your login. Even if someone guesses or steals your password, they cannot log in without the 2FA code from your phone.

How 2FA Works

• You log in with your username and password.
• You are then asked for a 6-digit code from an app like Google Authenticator or Authy.
• This code changes every 30 seconds and is only visible on your phone.

Enable 2FA in cPanel

1. Log in to cPanel.
2. Search for Two-Factor Authentication in the search bar.
3. Click Set Up Two-Factor Authentication.
4. Open Google Authenticator or Authy on your phone.
5. Scan the QR code shown in cPanel.
6. Enter the 6-digit code from your app into cPanel to confirm.

Enable 2FA in DirectAdmin

1. Log in to DirectAdmin.
2. Go to the Security or Two-Step Authentication section (wording may vary).
3. Enable two-step authentication.
4. Scan the QR code with Google Authenticator / Authy.
5. Save changes and test a new login.

✔️ Always keep at least one backup 2FA recovery code safe, in case you lose your phone.

✔️ Step 3: Protect Your Login URL and Access Location

On many servers, the cPanel login URL looks like:

https://yourdomain.com/cpanel
https://server.yourhost.com:2083

DirectAdmin has similar patterns. While you cannot normally change the core login URL like a WordPress login, you can still control who and from where can reach it.

Good Practices

• Always log in over HTTPS only (never HTTP).
• Avoid logging in from public Wi-Fi like cafes, cyber cafés, or shared PCs.
• If you must use public networks, use a VPN.
• Log out properly after each session.

IP-Based Restrictions (Advanced but Useful)

If you have a static IP (for example, at your office), you can ask support to restrict cPanel / DirectAdmin access to that IP only. This means only your office network can access the panel.

⚠️ Do not enable strict IP restriction if your internet provider changes your IP frequently — you may lock yourself out.

✔️ Step 4: Monitor Logins and Access History

Both cPanel and DirectAdmin keep logs of certain actions and logins. You should check them occasionally to ensure no one else is accessing your account.

In cPanel

• Use the Last Login info (often shown on the sidebar).
• Check Raw Access and metrics to see unusual traffic.
• Some setups show IP and time of last login directly on the dashboard.

What to Watch For

• Login times when you were sleeping or offline.
• Logins from countries you never visit.
• Multiple failed login attempts.

⚠️ If you see suspicious login activity, immediately change your password and enable 2FA if it is not already enabled.

✔️ Step 5: Protect Important Features Inside cPanel / DirectAdmin

Securing the control panel login is only part of the story. You should also protect high-risk sections inside it.

File Manager

• Do not give File Manager access to anyone you do not fully trust.
• Do not upload random ZIP files from unknown sources.
• Be careful when editing .htaccess and wp-config.php — one mistake can break your site.

MySQL / Databases

• Never publicly share your database credentials.
• Use strong database passwords.
• Delete unused databases to reduce risk.

Email Accounts

• Use strong passwords for email too (not “welcome123”).
• Regularly remove email accounts no one uses.
• Do not allow old or ex-employees to keep using company emails.

DNS Zone Editor

• DNS controls where your domain points.
• Do not change DNS records unless you understand them.
• One wrong record can break your website or email delivery.

⚙️ Developer and Freelancer Access (How to Share Safely)

Many Nairahost users work with web designers or developers who need hosting access. Giving them your main hosting credentials is risky, especially if you do not know them well.

Safer Ways to Share Access

• Ask if they can work with only WordPress admin instead of full cPanel.
• Change your hosting password before and after giving temporary access.
• Never reuse your hosting password on other sites.
• Avoid sending passwords as plain text in chats. If possible, use password sharing tools.

⚠️ After any external work is finished (developer, freelancer, agency), always change your hosting and admin passwords.

✔️ Step 6: Combine Panel Security with Website Security

Even if your cPanel is secure, your site can still be hacked through WordPress or other apps. Likewise, even if WordPress is secure, someone with your cPanel password can still compromise the site.

So you must secure both:

• cPanel / DirectAdmin login
• WordPress / app login
• FTP / SFTP access
• SSH (if available)

On Nairahost, using the correct nameservers also ensures secure DNS hosting:

• For cPanel hosting:

  ns1.nairahost.cloud
  ns2.nairahost.cloud

• For DirectAdmin hosting:

  ns1.nairahost.com.ng
  ns2.nairahost.com.ng

❗ What to Do If You Suspect Your cPanel / DirectAdmin Is Compromised

If you think someone has accessed your account without permission:

1. Change your cPanel / DirectAdmin password immediately.
2. Enable or reset Two-Factor Authentication.
3. Check for unfamiliar email accounts, databases or cron jobs.
4. Scan your website for malware using a security plugin or external scanner.
5. Reset passwords for WordPress admin users and critical email addresses.
6. Open a support ticket with Nairahost and explain what you noticed.

⚠️ Time is important. The faster you react, the less damage an attacker can do.

✔️ Final Security Checklist for Your Hosting Panel

• ✔️ Strong, unique hosting password
• ✔️ Two-Factor Authentication enabled
• ✔️ You do not use “admin” as a username anywhere
• ✔️ No unknown logins in your history
• ✔️ No extra hosting access shared with old developers
• ✔️ DNS records look correct, no strange redirects
• ✔️ Only required databases and email accounts exist
• ✔️ You changed your password after any external work