cPanel/WHM: root login suddenly fails (cPHulk)

What this is#

Your VPS runs cPanel/WHM, and the root password that worked yesterday is suddenly rejected on SSH or WHM, sometimes intermittently. In almost every case that's cPHulk, cPanel's built-in brute-force protection: when bots hammer your server with failed root logins (which happens to every public server), cPHulk locks the root account, and then rejects even the correct password, including yours.

Get back in#

The lock is on the account, not on the machine, so use the Console in your client area (it authenticates through the VPS's screen, and a reboot from the panel also clears the immediate lock). Once you're in as root, either:

• Disable cPHulk entirely:

/usr/local/cpanel/bin/cphulk_pam_ctl --disable

• Or keep it, but tune it in WHM under Security Center → cPHulk Brute Force Protection: whitelist your own IPs so your logins can never be locked out, and let it keep punishing everyone else.

Our take#

cPHulk locking root out of its own server is a known nuisance. If you keep it enabled, whitelisting your IPs is essential, otherwise every bot wave can lock you out again. If you'd rather not play that game, disable cPHulk and rely on SSH keys plus our network's own port-22 brute-force firewall, which blocks attackers' IPs without ever locking your account.

Still need help?#

You can open a support ticket. So we can help on the first reply, it's worth mentioning:

• the VPS hostname or IP,
• whether the correct password fails on SSH, WHM, or both,
• whether the Console still gets you in.

Related questions#

• "My root password stopped working after installing cPanel."
• "Why can't I log in to WHM or SSH with the correct password?"
• "How do I disable cPHulk?"
• "How do I whitelist my IP in cPHulk?"