Is there a reason why a host would be reluctant to give up Cpanel access info?

[Masbro]

Granted, a strange question here...

My client lost her cpanel login credentials, or never bothered to get them (she didn't even know she had a hosting account). Apparently she has a friend who is hosting her website for her, free of charge.

I need to get into the cpanel, but they are being extremely difficult. The client asked them and they didn't want to give it to her either. Still trying, but is there any reason why they would be so difficult? How does it benefit them? It can't be because they're afraid of losing her account because she isn't paying them anything. Totally confused by this. Any ideas?

[WhiteboardCreations]

Masbro, sounds like a bait and switch tactic, which stinks. However, you can now approach it from 2 additional angles for your client: 1) Have them pay for 1 month of cPanel access at that $45 rate, then get in there, take a complete back up of the website files and database file (if a CMS like WordPress) and then create a new web hosting account in HostGator or GoDaddy or anywhere feasible to your client and a server you're used to working in. Or 2) Just request from that company a full, most recent backup copy of the website files and DB and then you can upload those files to a new host as noted above, then change the DNS records for the domain to point to the new server. I'd find out that cost and see which is the cheaper alternative, however, either way, I would get your client away from them and cancel any monthly fees. Move on and with you by their side!

NOTE: Careful with the email hosting. So make sure you know where their email is hosted if using the same domain. If setting up a new host with their backup copy, then you can figure out the Mail settings/MX records as needed to make any modifications necessary.

Hope you get things resolved! It sounds like they are willing to play ball, so that's a huge plus for you and the client.

• Patrick

[Masbro]

Thanks for the detailed explanation. I think that was it. At first I thought perhaps it was some blackhat hosting, but it appears they are legit; however, they are now asking my client to pay $45 a month to to get cpanel for linux dedicated license. I don't know why she would go through all that when Hostgator is less than $4 a month.

[WhiteboardCreations]

Masbro,

We run into this issue all the time working with small business owners. They have a friend's cousin's nephew from down the street get them a website and don't tell them anything about what really is going on with their domain purchase/renewals, where they bought the domain, where they bought the hosting, the login for hosting, where they are hosting email, or logins to WordPress/Drupal/etc if using a CMS. The list goes on.

Unfortunately for us, we have to figure all of that out for them. Although, fortunately, we also get to build a great rapport with the client and educate them on making sure they maintain control over all of their property. I would educate them about all you know for consolidating their domain, hosting and email if you wanted and make sure you keep a login record and you share that with them as well. If they lose it, then you have it.

Now, to answer your question. Many folks are very hesitant to provide direct cPanel access because they may be in a shared environment with many other domains and websites being hosted. So, once they give you login, then you may be able to see ALL of their clients or websites and, to me, that is a big security vulnerability. I'd never allow just anyone into our shared server.

They may also just want to validate who you are in representing your mutual client on their behalf. Usually a phone call to them, with the client on the line is a good starting point, or an email from the client to the host provider.

It really all depends on the level of work you have to do. If it's minor, then you can ask them to provide FTP or SFTP login OR if it's something major or a brand new website, then another alternative you could request is for them to simply provide you a full backup of the website/database files (if any) and you can move the hosting to another provider where you have a little more control.

I believe they are simply looking at this from a security viewpoint. Allowing you access, wouldn't be beneficial to their other clients in the server, putting them at risk potentially.

Again, there are several ways to get to the end point based on your goals and needs for the client. We see it all the time and sometimes it goes smoothly, and others, it can be a long-drawn out nightmare. I hope it's not that latter for you And I hope this was a helpful answer!

• Patrick

[Martijn_Scheijbeler]

Well I'd say they want to be sure they have the real person who owns the accounts in front of them and they can't be sure. The CPanel usually provides you with access to databases and all the domain settings. So if you want to do bad this is the absolute best way to go to get sites down usually.