If you've lost, reset or replaced the phone that holds your cPanel two-factor authentication (2FA) codes, you can still get back into cPanel. Work through the options below in order. Most people are back in within minutes.
Important: two-factor authentication is controlled by you, the account owner. The Instant Access Internet Services support team does not turn 2FA on or off for customers, so the options below are the way back in, and saving your setup key is the best protection against getting locked out.
Option 1: Restore your authenticator app on the new phone
Many authenticator apps back up or sync your codes:
- Google Authenticator can sync codes to your Google account. Install it on the new phone and sign in with the same Google account.
- Microsoft Authenticator has a cloud backup option. Install it and choose to restore from backup.
- Password managers such as 1Password or Bitwarden keep codes with your other passwords, so they appear on any device you sign in on.
If your cPanel code shows up, log in as normal. Then go to Security > Two-Factor Authentication and click Reconfigure if you want to link a fresh code to the new phone.
Option 2: Use the setup key you saved
When you first set up 2FA, cPanel showed a text Key below the QR code. If you saved it (for example in a password manager), open your authenticator app, add an account manually and enter that key. The app will produce the same codes as your old phone.
Option 3: Use a device that's still logged in
If cPanel is still open in a browser somewhere - a work computer, a laptop - use that session:
- In the open cPanel window, go to Security > Two-Factor Authentication.
- Click Reconfigure and scan the new QR code with your new phone, or click Remove Two-Factor Authentication and set it up again later.
Also try the Log in to cPanel button in the client area (Services > My Services > your hosting plan). If it takes you into cPanel, reconfigure 2FA the same way.
Will support turn off 2FA for me?
No. We don't turn two-factor authentication on or off for customers. It's your security setting, and keeping it in your hands is what makes it protect you. Use one of the options above to get back in, then reconfigure 2FA with your new phone.
Prevent this next time
- Turn on backup or sync in your authenticator app.
- Save the setup key in your password manager when you set up 2FA.
- When you change phones on purpose, move your codes before wiping the old phone (or use Reconfigure in cPanel while you still have it).
- Keep your cPanel contact email current, so account notices reach you.
Common questions
I still have my phone, but the codes are rejected
That's usually a clock problem, not a lost device. Set your phone's date and time to update automatically, wait for a new code, and enter it promptly.
I keep trying and now nothing on the server loads
Repeated failed logins can make the firewall temporarily block your IP address. Stop trying and include your IP (from whatismyipaddress.com) in your ticket so we can clear it too.
Are my email and website affected while I'm locked out?
No. 2FA only guards the cPanel login. Your website, email and webmail keep working normally.
Related guides
- How to Set Up Two-Factor Authentication (2FA) in cPanel
- How to Log In to cPanel from the Client Area
- How to Log In to cPanel Directly and Reset a Forgotten Password
- How to Change Your cPanel Password
Still stuck? Open a support ticket and the Instant Access Internet Services team will help.
