Turkey (Turkish)
Germany (German)
Worldwide (English)
WHM portu2087 secure, 2086 unsecured administration
Halkali merkez neighborhood fatih st ozgur apt no 46 , Kucukcekmece , Istanbul , 34303 , TR
Sites and SSH running, WHM port 2087 or cPanel port 2083 not opening, the issue may be cpsrvd, listening port, CSF/firewalld, cPHulk IP block, data center firewall, hostname DNS, or service certificate.
This site can’t be reached
SERVER_IP took too long to respond
ERR_CONNECTION_TIMED_OUT
curl: (7) Failed to connect to port 2087
The cpsrvd service appears to be down.The timeout of the 2087 connection indicates that the browser's TCP session could not be completed or no response was received. Connection refused, on the other hand, suggests that the target was reached but there was no service listening on the port or an active rejection was received.
If curl -kI https://127.0.0.1:2087 is successful from within the server but fails from outside, it means cpsrvd is running; investigate firewall, IP blocking, network routing, or data center security group.
If both localhost and external connections fail, cpsrvd/cpanel.service, port listening, file descriptor limit, service certificate, and cPanel error log are prioritized.
Only a single internet connection or IP is affected, cPHulk, CSF deny, fail2ban, data center ACL, or local ISS rule is checked. There is no issue in everyone, so it is unnecessary to restart the service.
If the hostname does not open but the IP opens, there may be a DNS A/AAAA record, proxy, wrong hostname certificate or SNI/redirect issue.
Disabling the firewall completely hides the source of the problem and may leave management ports open to the internet. First, test on localhost, listen socket, and source IP block.
Search for the phrase you see in the email, browser, or SSH log. Each card includes meaning, probable cause, and safe initial action.
Meaning: TCP connection has not been completed within the specified time.
Possible cause: Firewall drop, upstream ACL, route, service unresponsiveness, or incorrect IP.
Meaning: The target system has actively rejected the connection or is not listening on the port for a service.
Possible cause: cpsrvd is closed, wrong bind, firewall reject or service is being restarted.
Meaning: cPanel failed to pass the internal web service health check.
Possible cause: cpsrvd crash, port conflict, certificate, disk or cPanel file issue.
Meaning: Service is healthy locally; external network path is blocked.
Possible cause: CSF, firewalld, nftables, cPHulk, provider firewall, or router.
Meaning: A global service failure is more likely to occur on the client.
Possible cause: CSF deny/tempban, cPHulk brute force, fail2ban or upstream ACL.
Meaning: cpsrvd was unable to open a new socket or file descriptor.
Possible cause: FD limit, connection leak or excessive session.
Meaning: WHM Certificate Hostname Doesn't Match the One Offered in WHM
Possible cause: The hostname DNS is incorrect, the service SSL is old or accessed via IP.
Meaning: Login page opened but API/session request has been terminated.
Possible cause: Proxy/WAF, cpsrvd restart, session cookie, time synchronization issue, or network interruption.
Meaning: Service is listening on a specific IP or loopback only.
Possible cause: Incorrect service bind, IP change, or corrupted cPanel IP pool.
Meaning: cPanel services or DNS may be using the old primary IP.
Possible cause: NAT, mainip, network scripts, hostname A record or license IP mismatch.
Meaning: The same cpsrvd may be experiencing issues on a different service port or user redirection
Possible cause: Firewall port list, proxy subdomain, user session, or service configuration.
Meaning: The connection has been closed by the service or the intermediate security layer after the TCP session was established.
Possible cause: cpsrvd crash, TLS handshake, WAF/proxy or resource limit.
No records matching this expression were found.
Commands are for root access. Collect only status and logs first; Do not change the permanent setting without seeing the reason.
/usr/local/cpanel/scripts/restartsrv_cpsrvd --status
systemctl status cpanel -l --no-pagercPanel displays the internal web service's process and systemd status.
ss -lntp | grep -E ':(2082|2083|2086|2087|2095|2096)\b'cPanel and WHM port numbers that are being listened on which PID and address are shown.
curl -vkI --connect-timeout 5 https://127.0.0.1:2087/
curl -vkI --connect-timeout 5 https://$(hostname -f):2087/Separates the service layer from the external network/firewall layer.
tail -n 200 /usr/local/cpanel/logs/error_log
journalctl -u cpanel -n 150 --no-pagercpsrvd, TLS, port, source, and startup errors are displayed.
csf -g KAYNAK_IP 2>/dev/null
csf -l 2>/dev/null | grep -E '2083|2087'Check if the source IP is in the deny/temp list and port permissions.
firewall-cmd --list-all 2>/dev/null
nft list ruleset 2>/dev/null | grep -E '2083|2087' | head -n 80
iptables -S 2>/dev/null | grep -E '2083|2087'Shows the processing of management ports in the active firewall infrastructure.
/usr/local/cpanel/bin/whmapi1 read_cphulk_records list_name=brutes | head -n 100
/usr/local/cpanel/bin/whmapi1 read_cphulk_records list_name=black | head -n 100Examines brute force and blacklist records via API.
echo | openssl s_client -connect HOSTNAME:2087 -servername HOSTNAME 2>/dev/null | openssl x509 -noout -subject -issuer -dates -ext subjectAltNameWHM checks the service certificate offered on the port.
The fastest method is to test whether the service responds on localhost, then sequentially separate the port listening, log, firewall, source IP, and hostname layers.
If Localhost is successful, the service is running and the problem is likely to be in the firewall/network path. If Localhost fails, focus on cpsrvd and logs.
curl -vkI --connect-timeout 5 https://127.0.0.1:2087/It is being listened to by the PID of cPanel of 2087 at the correct address and check the cpanel.service status.
ss -lntp | grep ':2087'
/usr/local/cpanel/scripts/restartsrv_cpsrvd --statusIf there is a port conflict, certificate, file descriptor, or startup error, save before restart.
tail -n 200 /usr/local/cpanel/logs/error_logIf only one connection is affected, search for the IP in CSF, cPHulk, and other security tools. Do not blindly close all firewalls.
csf -g KAYNAK_IP 2>/dev/nullIf the service is really down, use the cPanel restart script and then re-check the port/log status.
/usr/local/cpanel/scripts/restartsrv_cpsrvd
sleep 3
ss -lntp | grep ':2087'Different hostnames:2087 and IP:2087 are tested from a different network; TLS certificate and DNS target are checked.
curl -vkI --connect-timeout 8 https://HOSTNAME:2087/cpsrvd is healthy. CSF/firewalld/nftables, data center security group, DDoS protection, and network route are checked.
curl -skI https://127.0.0.1:2087/
ss -lntp | grep ':2087'cPHulk or CSF temporary ban probability is high. Testing, diagnosis is accelerated with a different source IP such as mobile internet.
csf -g KAYNAK_IP 2>/dev/null
grep -R "KAYNAK_IP" /var/log/lfd.log /usr/local/cpanel/logs/cphulkd.log 2>/dev/null | tail -n 50The hostname A/AAAA record, Cloudflare proxy, DNS cache and service certificate are checked. The WHM hostname must be resolved directly to the server IP.
hostname -f
dig +short A $(hostname -f)
dig +short AAAA $(hostname -f)A valid service SSL certificate must be loaded for the hostname. Name mismatch is normal when accessing via IP.
/usr/local/cpanel/bin/checkallsslcertsEven if the server's firewall is open, the upstream security group 2087 may still be blocked. Check the inbound rules and source IP allowlist in the provider panel.
traceroute -T -p 2087 SUNUCU_IP 2>/dev/null | tail -n 20WHM access via SSL is default on port 2087, cPanel user access via SSL is on port 2083. Ports 2086 and 2082 are their non-SSL counterparts and are not recommended for regular use.
Timeout usually indicates that the package was dropped or no response was received; refused indicates that the target was reached but no service was found on the port or an active reset was received.
WHM is the internal web service of cPanel that provides the WHM, cPanel, and Webmail interfaces. It is controlled via cpanel.service and restartsrv_cpsrvd.
Service is running; CSF, firewalld, cPHulk, data center firewall, DDoS protection, or network route is blocking external connection.
Failed logins may have caused cPHulk or CSF to impose a temporary ban. The source IP must be searched in the security logs.
This is the required port for WHM. It should be protected with a strong password, two-factor authentication, cPHulk, IP allowlist, and an up-to-date cPanel.
The hostname DNS is going to the wrong IP, AAAA record is faulty, proxy is being used or service SSL certificate does not match the hostname.
The /usr/local/cpanel/scripts/restartsrv_cpsrvd command is used on the cPanel server. The cPanel error_log must not be recorded beforehand, and port listening must be verified afterwards.
By analyzing cPanel, WHM, CloudLinux, LiteSpeed, MariaDB, Exim and security layers together, we fix the root cause of the failure instead of just removing the service.