# cPanel/WHM: root login suddenly fails (cPHulk)
Source: https://vpsdime.com/knowledgebase/troubleshooting/cpanel-cphulk-login-blocked
Last reviewed: 2026-07-02
Summary: On a VPS running cPanel/WHM, the correct root password can suddenly stop working for SSH and WHM because cPHulk brute-force protection locked the account after someone's failed attempts. How to get in, disable or tune cPHulk, and whitelist your IP.

## What this is

Your VPS runs **cPanel/WHM**, and the root password that worked yesterday is suddenly rejected on SSH or WHM, sometimes intermittently. In almost every case that's **cPHulk**, cPanel's built-in brute-force protection: when bots hammer your server with failed root logins (which happens to every public server), cPHulk locks the root account, and then rejects even the **correct** password, including yours.

## Get back in

The lock is on the account, not on the machine, so use the **[Console](https://vpsdime.com/knowledgebase/client-area/services/managing-your-vps)** in your client area (it authenticates through the VPS's screen, and a reboot from the panel also clears the immediate lock). Once you're in as root, either:

- **Disable cPHulk** entirely:

```
/usr/local/cpanel/bin/cphulk_pam_ctl --disable
```

- Or keep it, but **tune it** in WHM under **Security Center → cPHulk Brute Force Protection**: whitelist your own IPs so your logins can never be locked out, and let it keep punishing everyone else.

## Our take

cPHulk locking root out of its own server is a known nuisance. If you keep it enabled, **whitelisting your IPs is essential**, otherwise every bot wave can lock you out again. If you'd rather not play that game, disable cPHulk and rely on [SSH keys](https://vpsdime.com/knowledgebase/getting-started/securing-your-vps) plus our network's own [port-22 brute-force firewall](https://vpsdime.com/knowledgebase/client-area/support/ssh-firewall), which blocks attackers' IPs without ever locking your account.

## Still need help?

You can [open a support ticket](https://vpsdime.com/open-ticket/). So we can help on the first reply, it's worth mentioning:

- the VPS hostname or IP,
- whether the correct password fails on SSH, WHM, or both,
- whether the Console still gets you in.

## Related questions

- "My root password stopped working after installing cPanel."
- "Why can't I log in to WHM or SSH with the correct password?"
- "How do I disable cPHulk?"
- "How do I whitelist my IP in cPHulk?"