2083

Port 2083 – cPanel HTTPS

TCP

Port 2083 is the cPanel HTTPS port – the encrypted version of the web hosting control panel. All cPanel login and management should use port 2083 exclusively. This port also serves RadSec (RADIUS over TLS, RFC 6614) on networks that use it. Restrict access to known admin IPs when possible.

Port Number

2083

Protocol

TCP

Service

cPanel Web Interface (SSL)

Range

IANA Registered (1024–49151)

Description

cPanel HTTPS on port 2083 provides TLS-encrypted access to the hosting control panel. All modern cPanel installations default to redirecting HTTP (port 2082) to HTTPS (port 2083). The TLS certificate is either the server's main certificate or a cPanel-specific AutoSSL certificate. cPanel on port 2083 is a high-value target – it provides full control over hosted websites, databases, email, and DNS. Attackers who compromise a cPanel account can inject malware into websites, redirect email, and pivot to other accounts on the same server. Enable two-factor authentication, use cPHulk for brute-force protection, and restrict port 2083 access to specific IP addresses via CSF/iptables where feasible.

Security risks

1CVE-2023-29489: cPanel XSS via web disk CNAME – allows unauthenticated reflected XSS on any cPanel-managed domain, stealing session cookies for port 2083 login
2AutoSSL token exposure: cPanel's Let's Encrypt validation creates predictable .well-known paths that can be pre-staged by attackers on sites with web application vulnerabilities
3Session fixation: older cPanel versions were vulnerable to session fixation attacks via crafted URLs to port 2083, allowing account takeover after victim clicks a link
4Full hosting control: compromised port 2083 access gives: file manager (read/write all files), MySQL access (all databases), email accounts (read all mail), DNS control, SSH keys, cron jobs
5Shared hosting blast radius: on shared servers, cPanel isolation (CloudLinux CageFS) is the boundary. Escape from one cPanel account potentially reaches all 200+ accounts on the server

Firewall guidance

Port 2083 must be accessible from customer IPs for shared hosting. Mitigations: enable 2FA for all accounts (WHM → Two-Factor Authentication → require), enable cPHulk (brute-force protection with progressive delays and IP bans), set session timeout to 30 minutes, enable 'Cookie IP validation' in Tweak Settings. For dedicated servers: restrict 2083 to admin IPs via CSF.

Diagnosis commands

Check if 2FA is required for all cPanel accounts

shell

whmapi1 twofactorauth_policy_status

Verify cookie IP validation is enabled

shell

whmapi1 get_tweaksetting key=SecurityPolicy::CookieIPValidation

Check cPHulk brute-force protection activity

shell

cat /var/log/cphulkd.log | tail -20

Count hosted accounts (assess blast radius)

shell

whmapi1 listaccts | grep -c 'domain'

Usage examples

Port 2083 – cPanel HTTPS

shell

curl -k https://server:2083/login/
iptables -A INPUT -p tcp --dport 2083 -s ADMIN_IP -j ACCEPT
whmapi1 listaccts

Common services on this port

cPanel (account-level hosting management)

Related ports

2083

cPanel HTTPS (this port)

2082

cPanel HTTP (disable this)

2087

WHM HTTPS (root admin)

2096

Webmail HTTPS

History

Port 2083 is the HTTPS counterpart to cPanel's original HTTP port (2082). As HTTPS became standard, cPanel added TLS support on 2083. Modern cPanel installations should disable 2082 entirely and only serve on 2083. cPanel's market dominance in shared hosting (70%+ of the managed hosting market) makes port 2083 a high-value target – automated scanners check every IP for cPanel presence.

FAQ

How do I harden cPanel access on port 2083?

1. Enable 2FA (WHM → Security Center → Two-Factor Authentication, set policy to Required). 2. Enable cPHulk with strict settings (5 failures = 15 min ban, 15 failures = 24h ban). 3. Cookie IP validation ON. 4. Session timeout: 30 minutes. 5. Restrict WHM (2087) to admin IPs via CSF allow list. 6. Enable ModSecurity with OWASP CRS for hosted sites. 7. Force password complexity (12+ chars) via Password Strength Configuration.

Can I change cPanel's port from 2083?

Not recommended and not officially supported. cPanel hardcodes many internal services to expect port 2083. Changing it breaks: AutoSSL validation, API integrations, WHMCS provisioning, and customer documentation. Instead: use CSF/iptables to restrict WHO can reach 2083. If you need to hide cPanel's existence: use Cloudflare proxy (which only passes 80/443) and access cPanel via direct IP.