I have a website hosted on SiteGround. Their CPanel can be served via http or https ( http://cpanel.us261.siteground.us/login/ ). In my case it is not working via https; the support says it's because I don't have a dedicated IP.

Question: how is it safe to use CPanel over HTTP? I understand they are using something like CSRF protection tokens, but if someone were to intercept my CPanel login, what would prevent them from being able to delete all my files? And why do I need a static IP in this case, when I can use every other website over HTTPS, including the one I am hosting, just fine?

Update: I have found a workaround by using a mobile hotspot to connect to the Internet when I need the CPanel. I am still unsure what's wrong, however. Note that I have no issues with accessing my own website via HTTPS, that is fine.

  • You using the wrong path for a start... it should be https://cpanel.us261.siteground.us:2083/ and then allow your browser to use a unsigned SSL. In any case nothing we can say will change the outcome, contact your host and make a complaint. – Simon Hayter May 27 '19 at 17:40
  • What happens when you request http://yourdomain.com/cpanel (as stated in the SiteGround KB)? (From what is suggested on that page I would perhaps expect it to redirect you to HTTPS on port 2083 probably on a siteground specific URL.) "the support says it's because I don't have a dedicated IP" - That doesn't sound right. The cPanel URL given is a siteground.us domain - not your own domain. And nor should you have to permit a self-signed cert (as @SimonHayter suggests above). – DocRoot May 27 '19 at 22:35
  • What happens is nothing, no response from https://secureus261.sgcpanel.com:2083, which is where it redirects. – osa Jun 6 '19 at 4:06
  • http://yourdomain.com/cpanel to access cPanel securely or - Wow. Seems like a complete incompetent or negligent hosting provider. Possibly both. – Esa Jokinen Jun 9 '19 at 12:43

HTTP requests are sent clear text and can be read with any sniffer. CSRF is for cross site scripting attacks, but what about malware/backdoors on routers or other man in the middle attacks?

Re why you can't use SSL, I would bet that it's your SSL vendor that is insisting on a static IP address. If you've contacted hosting support without success, you might look at getting your SSL cert from the same vendor that provided the SSL certs for you other sites.

  • Actually my SSL works fine, my site is accessed via HTTPS. It's the CPanel which is the problem. I found a workaround by using a mobile hotspot to connect to the Internet when I need the CPanel. – osa Jun 6 '19 at 4:07

It is most likely not very safe to use CPanel without a SSL or https:// prefix (that has a verified certificate, of course) because, as mentioned above, any sort of sniffer program (a very common one, https://www.wireshark.org/) can easily detect any packets that are being transferred, and not to mention classic man in the middle attacks, as mentioned above, and those packets include your personal information.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.