The WHM root password on a VPS or dedicated server is the most privileged credential you have — it controls every cPanel account, every service, and the underlying operating system. This article covers how to change it, both when you're logged in and when you're not.
Change the password while logged in
If you still have access to WHM, this is the quickest way:
- Log in to WHM at
https://yourhostname.canspace.ca:2087. - In the left-hand menu, search for password and click Change Root Password (under Server Configuration).
- Enter your current password, then a new password twice, and click Change Password.
This updates both the WHM login and the underlying Linux root account — they're the same credential. Any open SSH sessions will continue to work, but new SSH logins will require the new password.
Choose a strong password
Because this password controls your whole server, the bar should be higher than for a normal account:
- 20+ characters, ideally generated by a password manager.
- Never reuse it anywhere else and never share it in a chat, email, or ticket (we don't need it and will never ask for it).
- Consider pairing it with a separate sudo user and disabling direct root SSH login — a more involved setup, but it significantly raises the security bar. If you'd like us to help configure this on your server, open a ticket.
Locked out of WHM
If you've forgotten the password and can't log in, open a support ticket. On a VPS or dedicated server you own, the root password isn't stored anywhere we can retrieve — but we do have out-of-band access to the server (via the hosting provider's management console) and can reset it for you. Include in the ticket:
- The server hostname (e.g.
dedi123.canspace.caorvps2099.canspace.ca). - Confirmation that you'd like the root password reset — we'll send the new password through the ticket once it's done.
Because this is a privileged operation, tickets requesting a root password reset must be submitted from the client area, not via email, so we can verify you're the account owner.
After changing the password
If you use any automation that authenticates to WHM or SSH — deployment scripts, monitoring agents, CI/CD pipelines, cron jobs that call whmapi1 from elsewhere — update them with the new password or, better, switch them to SSH keys or WHM API tokens. Leaving old credentials in scripts will generate failed-login alerts and can get the script's IP firewall-blocked.
Related articles
Still stuck? Open a support ticket
