Skip to main content
protocols.pageprotocols.page
2082

Port 2082 – cPanel HTTP

TCP

Port 2082 is the cPanel web hosting control panel HTTP port. cPanel provides website, email, database, and DNS management for shared hosting accounts. Port 2082 is unencrypted – always use port 2083 (HTTPS) instead. Exposed cPanel ports are prime targets for credential stuffing and brute-force attacks against hosting accounts.

Port Number

2082

Protocol

TCP

Service

cPanel Web Interface

Range

IANA Registered (1024–49151)

Description

cPanel on port 2082 serves the unencrypted web interface for shared hosting management. Users access file managers, email configuration, MySQL databases, and DNS zone editors through this interface. WHM (Web Host Manager) for server administrators runs on port 2086/2087. Port 2082 transmits login credentials in cleartext – any network observer between the user and server can capture hosting account passwords. Modern cPanel installations should redirect port 2082 to 2083 (HTTPS) automatically. Rate-limit login attempts with cPHulk brute-force protection. Consider restricting cPanel port access to specific IP ranges for high-value hosting accounts.

Security risks

  • 1Plaintext credentials: port 2082 transmits cPanel login credentials (username + password) in cleartext HTTP – any network observer captures full hosting account access
  • 2CVE-2020-27641: cPanel 2FA bypass via alternate port – attackers could bypass two-factor authentication by accessing specific API endpoints on port 2082
  • 3Full account control: cPanel access grants file manager (webshell upload), email access, database management, DNS modification, and SSH key management for the account
  • 4Brute-force endpoint: cPanel login pages on port 2082 are actively scanned and brute-forced by botnets targeting weak passwords on shared hosting
  • 5Port 2082 should not exist in production: cPanel supports automatic redirect from 2082→2083 (HTTPS). Any active use of port 2082 indicates a TLS misconfiguration

Firewall guidance

Disable port 2082 entirely – force HTTPS via cPanel's 'Always Redirect to SSL' setting (WHM → Tweak Settings → Always redirect to SSL/TLS). If you must keep 2082 open temporarily: configure it to redirect (302) to port 2083 only. Block port 2082 at the server firewall (CSF: TCP_IN remove 2082). Enable cPHulk brute-force protection.

Diagnosis commands

Check if port 2082 redirects to HTTPS (should redirect to :2083)

shell
curl -s -o /dev/null -w '%{redirect_url}' http://server:2082/

Check CSF firewall (common on cPanel) for blocked IPs

shell
csf -g IP_ADDRESS

Verify Always Redirect to SSL is enabled

shell
whmapi1 get_tweaksetting key=alwaysredirecttossl

Check which cPanel ports are active

shell
ss -tlnp | grep -E '2082|2083'

Usage examples

Port 2082 – cPanel HTTP
shell
curl http://server:2082/login/
ufw allow from ADMIN_IP to any port 2082
csf -a ADMIN_IP

Common services on this port

cPanel (shared hosting control panel)

Related ports

2082

cPanel HTTP (this port, insecure)

2083

cPanel HTTPS (use this instead)

2086

WHM HTTP (insecure)

2087

WHM HTTPS (admin)

2095

Webmail HTTP

2096

Webmail HTTPS

History

cPanel was created by Nick Koston in 1996 as a Unix web hosting control panel. Ports 2082/2083 were chosen as distinctive high-numbered ports unlikely to conflict with hosted websites. cPanel became the dominant shared hosting panel (estimated 1M+ servers). The HTTP port (2082) predates widespread HTTPS adoption – it remained as a fallback but should be disabled on all modern installations. cPanel was acquired by WebPros (OAKLEY Capital) in 2018.

FAQ

How do I force HTTPS-only on cPanel?

In WHM: Tweak Settings → Redirects → 'Always redirect to SSL/TLS' = ON. This makes port 2082 redirect to 2083 automatically. Then in CSF firewall: remove 2082 from TCP_IN to block direct HTTP access entirely. Also enable 'Require SSL' in WHM → Security Center. For the webmail ports: same approach (2095 → 2096 redirect).

Is cPanel secure enough for production hosting?

cPanel itself is reasonably secure when properly configured: enable 2FA (WHM → Two-Factor Authentication), restrict WHM to specific IPs (WHM → Security Center → Host Access Control), enable cPHulk brute-force protection, keep AutoSSL active, disable FTP (use SFTP only). The bigger risk is the hosted applications (WordPress, Joomla) – cPanel provides the isolation but can't protect poorly written PHP code.