Skip to main content
protocols.pageprotocols.page
2087

Port 2087 – WHM HTTPS

TCP

Port 2087 is the WHM (Web Host Manager) HTTPS port for server-level administration of cPanel servers. WHM provides root-level control: creating accounts, managing DNS clusters, configuring Apache/Nginx, and applying system updates. Compromise of port 2087 access means full server root equivalent – restrict to management IPs only.

Port Number

2087

Protocol

TCP

Service

Web Host Manager (SSL)

Range

IANA Registered (1024–49151)

Description

WHM on port 2087 is the server administration layer above cPanel. While cPanel (port 2083) manages individual hosting accounts, WHM manages the entire server – creating and suspending accounts, configuring web server settings, managing SSL certificates, and running EasyApache for PHP/Apache builds. WHM on port 2087 should be treated as equivalent to SSH root access. An attacker with WHM credentials can access all hosted accounts, read all databases, and modify system configuration. Never expose port 2087 to the general internet. Use CSF (ConfigServer Firewall) to whitelist only admin IP addresses. Enable two-factor authentication for all WHM reseller and root accounts.

Security risks

  • 1CVE-2021-38882: WHM privilege escalation – cPanel account user could execute commands as root via crafted API calls to WHM endpoints (CVSS 8.8)
  • 2Root-level access: WHM port 2087 provides full server administration: create/delete accounts, modify DNS, install SSL, access all databases, execute shell commands as root
  • 3Server-wide compromise: unlike port 2083 (single account), compromised WHM access compromises EVERY hosted account, every database, every email account on the entire server
  • 4Reseller privilege escalation: WHM reseller accounts with overly broad ACLs can escalate to root-level operations via less-restricted API endpoints
  • 5Default root login: fresh cPanel installations allow root login to WHM with the system root password – no separate credentials, no 2FA until manually configured

Firewall guidance

Restrict port 2087 to specific admin IP addresses ONLY (CSF: add admin IPs to /etc/csf/csf.allow, remove 2087 from TCP_IN for general access, use LF_WEBMIN = 1 in csf.conf). Enable 2FA for all WHM users including root. Consider: admin VPN required before WHM access (double-gate). Disable port 2086 (HTTP) completely – there's no reason for unencrypted root admin access.

Diagnosis commands

Check CSF firewall rules for port 2087 (should be IP-restricted)

shell
csf -l | grep 2087

Verify 2FA is enforced for WHM access

shell
whmapi1 twofactorauth_policy_status

Check recent WHM/root login history

shell
last -f /var/log/wtmp | grep 'whm\|root' | head -10

Recent WHM access log entries

shell
cat /usr/local/cpanel/logs/access_log | grep ':2087' | tail -10

Usage examples

Port 2087 – WHM HTTPS
shell
curl -k https://server:2087/
whmapi1 listaccts
csf -a ADMIN_IP # whitelist admin

Common services on this port

WebHost Manager (WHM)cPanel/WHM combined installation

Related ports

2087

WHM HTTPS (this port)

2086

WHM HTTP (disable immediately)

2083

cPanel HTTPS (account-level)

22

SSH (also provides root access)

History

WHM (WebHost Manager) is the server-level admin interface for cPanel, introduced in the early 2000s. Port 2087 was chosen as 2083+4 (adjacent to cPanel ports). WHM provides: account provisioning, DNS cluster management, EasyApache (PHP/Apache config), AutoSSL, security policies, and server migration tools. It's the de facto standard for managing shared hosting servers (used by thousands of hosting providers worldwide).

FAQ

How do I restrict WHM to specific IPs?

In CSF (ConfigServer Firewall): 1. Add admin IPs to /etc/csf/csf.allow (format: tcp|in|d=2087|s=YOUR_IP). 2. Remove 2087 from TCP_IN in /etc/csf/csf.conf. 3. csf -r to reload. Alternative without CSF: WHM → Security Center → Host Access Control → add rule: ALL deny, then your-IP allow. This IP restriction is the single most important WHM security measure.

Should I disable root login to WHM?

You can't fully disable root WHM access (it's needed for server-level operations). Instead: (1) enable 2FA for root, (2) IP-restrict port 2087, (3) use a WHM reseller account for day-to-day operations with limited ACLs, (4) only login as root for server-level changes (EasyApache, cluster config, security updates). Create audit trail: WHM → Security Center → Audit Log.