What to Do When Your cPanel Email Account Is Hacked
If a mailbox hosted on your cPanel server is sending spam, exposing messages, or forwarding mail without your permission, treat it as a mailbox compromise. A password reset is a good start, but it may not remove a forwarder, filter, or compromised device that still has access. Work through the checks below, and involve your hosting provider for server-level investigation.
First, confirm what was compromised
This guide is for an email address hosted by your cPanel provider, such as name@yourdomain.com. Outlook, Apple Mail, or a phone may only be the app used to connect to that mailbox. If the mailbox itself is hosted by Google Workspace or Microsoft 365, use that provider’s recovery process instead.
If you can still sign in, note when you first saw the problem, examples of unexpected messages, bounce notices, and any unfamiliar forwarding destinations. Save message headers or screenshots if practical. Do not delete evidence before your host has a chance to review it.
Reset the mailbox password and secure the devices
In cPanel, open Email Accounts, find the affected address, choose Manage, and set a new, unique password. Use a password that is not used for your cPanel login or any other account. cPanel’s Manage Email Accounts screen is where mailbox credentials and related settings are managed.
Update the saved password in every mail app and device you control. Remove mail apps, browser extensions, or devices you do not recognize. If you suspect the computer or phone may be infected, change the password from a trusted device after updating its operating system and running a reputable security scan.
If the cPanel account itself may be compromised, change its login password too and ask the host to review access to the hosting account. A mailbox password and cPanel login are usually separate; the cPanel system-user mailbox is an exception because it uses the cPanel account credentials.
Inspect cPanel forwarding and filtering
Open cPanel → Email → Forwarders. Review each forwarder for the affected address and remove destinations you did not create. Check for a domain forwarder if messages for the whole domain appear to be redirected.
Next, check Email Filters for the mailbox and Global Email Filters for the cPanel account. Look for rules that redirect, discard, pipe, or move mail, especially rules that apply broadly or match words such as “invoice,” “password,” or “security.” Remove only rules you cannot explain; preserve legitimate filters.
Check Autoresponders and any webmail settings for unexpected replies or rules. Review sent mail, drafts, and recent bounce messages for signs of bulk sending. A forwarding rule can expose incoming messages even after the password has changed.
Ask your hosting provider to investigate server activity
Contact your host promptly if mail is still being sent, you cannot change the password, the cPanel account may be compromised, or you find unauthorized settings. Give them the address, approximate time window, sample message IDs or headers, and what you already changed.
Ask the host to review mail logs and the outgoing queue for unauthorized sending, check for active IMAP/POP connections and suspicious authentication, and invalidate or terminate access where possible. Active Dovecot connection checks and termination are root-level administration; do not run server commands unless you administer the server and know the impact.
If your host confirms the server is clean but messages continue to disappear, check every connected device and third-party app again. Old clients may repeatedly retry with saved credentials or store a local copy of rules.
After access is restored
Send a short warning to affected contacts through a trusted channel if the mailbox sent suspicious messages. Tell them not to open attachments, use links, or act on payment or password requests from the messages.
Check that legitimate mail is arriving and that no unknown forwarders or filters return. If you rely on this address for password resets, update recovery details on important services and review recent sign-in alerts there.
If you need help securing a hosted mailbox or investigating suspicious mail activity, contact Cyber Damage Control to discuss the next steps for your hosting setup.