EraHost – Free Domain, Cheap Hosting!

Client Area

Support 24/7

EraHost – Free Domain, Cheap Hosting!

Home

› Hosting & servers › What is cpsess in cPanel & WHM?

What is cpsess in cPanel & WHM?

3 min read

16.04.2025

What is cpsess in cPanel & WHM?

cpsess is a session token used by cPanel, WHM, and Webmail for secure authentication. It is added to URLs to maintain an authenticated session while preventing cross-site request forgery (CSRF) attacks.

cpsess cPanel Session Token Security — cpsess — the per-session token that scopes cPanel URLs to one login.

For other cpanel-stack topics, see cpsrvd — cPanel Service Daemon Guide and "Installation already exists" — Softaculous Reinstall Fix.

Example of a cpsess URL in cPanel:

https://yourserver.com:2083/cpsess1234567890/frontend/paper_lantern/index.html

cpsess1234567890 > This is the session token.
It ensures that users remain logged in securely without repeatedly entering passwords.

Why is cpsess Used?

Prevents session hijacking by generating a unique token.
Protects against CSRF attacks by ensuring requests originate from authenticated users.
Improves security by making session URLs temporary and specific to each login.

Common Issues and Fixes for cpsess

Issue: "Invalid cpsess session" or Logout After Login

Cause: The session token expired or was invalidated.

Fix:

Clear Browser Cache and Cookies
Open browser settings > Clear cookies & cache.
Ensure Cookies Are Enabled
Some security extensions may block cookies. Disable them.
Check for IP Changes
If your ISP changes your IP frequently, enable "Cookie IP Validation: Loose" in WHM:
WHM > Tweak Settings > Cookie IP Validation > Loose

Restart cPanel Services

sudo systemctl restart cpanel

or

/usr/local/cpanel/scripts/restartsrv_cpsrvd

Issue: Redirect Loop with cpsess in URL

Cause: Corrupted session or incorrect redirection settings.

Fix:

Try Incognito Mode or another browser.
Remove cpsess from URL and try accessing:
https://yourserver.com:2083/

Restart Apache and cPanel services

sudo systemctl restart httpd
sudo systemctl restart cpanel

Issue: "Session Timeout" or "Invalid Security Token" in cPanel/WHM

Cause: Sessions are expiring too quickly.

Fix:

Increase session timeout in WHM:
WHM > Tweak Settings > Session Timeout (Set to 30+ minutes)
Ensure disk space is not full:
```
df -h
```
If /tmp or /home is full, clear unnecessary files.

How to Manually Invalidate cpsess Sessions

If you need to force logout all cPanel/WHM users:

rm -rf /var/cpanel/session_cleanup/*

Then restart the cPanel service:

sudo systemctl restart cpanel

Summary

Issue	Solution
cpsess invalid session	Clear cache, restart cPanel services
Redirect loop with cpsess	Try incognito mode, remove cpsess from URL
"Session Timeout"	Increase timeout in WHM, check disk space
Force logout all users	Delete session files in /var/cpanel/session_cleanup/

By following these steps, you can fix cpsess session issues and ensure secure cPanel/WHM access.

Frequently asked questions

Why does cPanel put the cpsess token in the URL instead of a cookie?

Historic: cPanel needed to work with browsers/clients that didn't always set cookies, and per-URL tokens make CSRF protection trivial (the token can be validated on every request without complex referer checks). Modern best practice would put it in headers, but changing the cpsess URL pattern would break every bookmarked admin URL and every helper script. So it stays in the URL.

Bookmarked cPanel URL with cpsess fails — why?

The cpsess token is bound to the session that issued it. The next login generates a new cpsess; the old URL with the old token returns 401. This is correct behavior — don't bookmark URLs with cpsess. Bookmark the cPanel login URL (`https://example.com:2083/`) and re-login each time.

How do I invalidate all cPanel sessions at once?

WHM → Account Functions → Manage Shell Access (for per-user), or kill the cpsrvd sessions globally: `/scripts/restartsrv_cpsrvd --hard`. Restarting cpsrvd hard expires all active sessions immediately. After password rotation, always restart cpsrvd to ensure the old credentials' sessions are dead.

Can I disable cpsess for easier scripting?

Don't. It's the primary CSRF defense for cPanel/WHM. For scripting, use the cPanel API instead — UAPI / WHM API has token-based auth meant for scripts. Stripping cpsess from URLs leaves the panel open to CSRF-from-evil-website attacks where the victim is the logged-in admin.

Related articles

What is PortQuiz.net? The Ultimate Port Testing Service Explained

Understanding the .cagefs Folder in CloudLinux (cPanel Hosting)

"Retry Timeout Exceeded" in cPanel: What It Means and How to Fix It

Hosting

Cloud Solutions

For You

VDS

Website Builders

Our services

Client Area

ICANN

18+ Service. By continuing to use this website, you agree to the use of cookies. More detailed information can be found on the "What are cookies"page.

© 2006 - 2026 EraHost. All rights reserved