cPanel 138 API Authentication and Meridian: WordPress Host Audit
cPanel changed the risk profile for server automation on July 14, 2026. When the new API-request security policy is enabled alongside two-factor authentication, session-authenticated API requests must complete 2FA, HTTP Basic authentication requests are denied, and API-token requests continue to work. New installations enable the policy by default. Existing servers are not switched automatically, although WHM may prompt administrators through Feature Showcase and Security Advisor.
This is an authentication-policy and workflow-compatibility change—not a WordPress core or plugin vulnerability. The practical business risk is operational: a failed backup, DNS update, SSL renewal, deployment, or account-provisioning job can lead to downtime, delayed launches, broken ecommerce workflows, or avoidable support escalations.
Need help checking this on your WordPress, Google Ads, Analytics, local SEO, or website setup? Splinternet Marketing can review the issue and help you prioritize the next fix.
Where WordPress hosting operations are exposed
Start with an inventory instead of enabling the policy immediately. Review backup jobs, provisioning scripts, DNS automation, deployment tools, reseller workflows, monitoring services, support utilities, and vendor integrations that call cPanel or WHM.
Search code repositories, cron definitions, CI/CD variables, configuration-management files, and vendor dashboards for:
- Browser-session cookies or session-based API calls.
- HTTP Basic authorization headers.
- Username-and-password authentication in scripts or environment variables.
- Undocumented legacy access methods, hard-coded ports, or custom wrappers around cPanel APIs.
Test both sides of the platform. Account-level WordPress tasks may use cPanel UAPI through the secure cPanel service, while server-wide or reseller operations may use WHM API 1. A backup vendor that works for one account may still fail when it provisions accounts, manages packages, or changes DNS through WHM.
When supported by the integration, move unattended jobs to documented HTTPS API-token patterns. cPanel documents the Authorization: cpanel username:token format for account-level UAPI calls, while WHM uses the corresponding Authorization: whm username:token pattern. Use the narrowest identity and permissions that can complete the task. Do not replace every integration with a root-level token.
What to do next
- Confirm the server state. Record the cPanel version, release tier, 2FA status, and whether “Apply Security Policies to API requests” is enabled. cPanel 138 and the Meridian release were made available on July 27, 2026, but update timing can vary by release tier and hosting provider.
- Classify every integration. Mark each job as session-based, HTTP Basic, username/password, token-based, or unknown. Treat unknown authentication as a testing priority.
- Rebuild credentials carefully. Create account-, reseller-, or service-specific tokens where possible. Store them in a secrets manager or protected CI/CD variable, restrict access, document ownership, and record rotation and revocation procedures. cPanel notes that WHM tokens must be saved securely because they are not available for later viewing.
- Run representative tests. Verify a backup and restore check, DNS record change, SSL or AutoSSL workflow, WordPress deployment, WooCommerce staging task, account-provisioning action, monitoring alert, and reseller support workflow.
- Evaluate Meridian separately. Meridian is an opt-in alternative to Jupiter, not a replacement for the API-authentication project. Test its navigation, user permissions, support procedures, and training independently from unattended automation. Users may be able to return to the Classic cPanel Theme when the hosting provider permits it.
Before enabling the policy across production servers, schedule the change outside peak business hours. Preserve current configuration exports, credential records, logs, and rollback instructions. After the change, run a smoke test for backups, DNS, SSL, deployments, provisioning, and customer-support access.
If a job fails, check the authentication type, API port, token permissions, credential status, and network or TLS errors before assuming the policy is the only cause. For managed hosting, confirm the provider’s rollout plan and supported authentication methods before changing production integrations.
Sources
Need help checking this on your WordPress, Google Ads, Analytics, local SEO, or website setup? Splinternet Marketing can review the issue and help you prioritize the next fix.
This article is for informational purposes only and reflects general marketing, technology, website, and small-business guidance. Platform features, policies, search behavior, pricing, and security conditions can change. Verify current requirements with the relevant platform, provider, or professional advisor before acting. Nothing in this article should be treated as legal, tax, financial, cybersecurity, or other professional advice.
Editorial note: Splinternet Marketing articles are researched from cited platform, documentation, regulatory, and industry sources. AI may assist with drafting and review; final content is checked for source support, practical usefulness, and platform/date accuracy before publication.
