--- title: "Control Web Panel Security Precaution: Temporary Control Panel Access Restrictions on VPS and Dedicated Servers" description: "As a security precaution, InMotion Hosting has temporarily closed the firewall ports used to reach the Control Web Panel (CWP) Admin and User panels on CWP VPS and Dedicated servers. We are taking thi..." url: https://www.inmotionhosting.com/support/news/cwp-security-precaution-panel-port-restrictions/ date: 2026-09-02 modified: 2026-09-02 author: "Derrell" categories: ["News / Announcements"] type: post lang: en --- # Control Web Panel Security Precaution: Temporary Control Panel Access Restrictions on VPS and Dedicated Servers **As a security precaution, InMotion Hosting has temporarily closed the firewall ports used to reach the [Control Web Panel (CWP)](https://www.inmotionhosting.com/support/edu/control-web-panel/logging-into-control-web-panel-cwp/) Admin and User panels on CWP VPS and Dedicated servers.** We are taking this step to protect your server from unauthorized access while we investigate suspicious activity targeting CWP. Your websites, email, and databases remain online and unaffected. To log in to CWP again, send us the public IP address you connect from, and we will add it to your server’s firewall allowlist. Details on what to send and where are below. ## What Happened Our security team has identified unauthorized activity targeting servers running Control Web Panel. This includes a weakness in the WordPress autologin feature that CWP added in version 0.9.8.1225 in May 2026. The flaw can be abused to log in to a WordPress site without valid credentials. CWP has not yet released a fix. Our investigation is ongoing, and we are treating all CWP servers as potentially exposed until CWP releases a fix. Closing the CWP control panel to the public internet is the fastest way to protect every affected server at once. ## What We Did We removed the following ports from the inbound rules in the ConfigServer Security & Firewall (CSF) configuration on CWP VPS and Dedicated servers: - 2082 and 2083 (CWP User panel) - 2030, 2031, 2086, and 2087 (CWP Admin panel) With these ports closed, your server no longer accepts connections to the CWP panels from the public internet. The panels themselves are still running. They are unreachable until your IP address is added to the firewall allowlist. ## What This Means for You - Your websites, applications, databases, and email continue to operate normally. - Attempts to open the CWP Admin or User panel will time out in your browser until we add your IP address to the allowlist. - SSH, SFTP, FTP, and webmail access are not affected. - Your [Account Management Panel (AMP)](https://secure1.inmotionhosting.com/amp) login is not affected. ## How to Restore Your CWP Access Our team will add your IP address to your server’s firewall allowlist so you can reach the CWP panels again. To make this a single round trip, include everything below in one request. ### What to send us - **Your public IPv4 address.** This is the IP address your internet connection uses, not your server’s IP. To find it, open a browser on the device you use to manage your server and search “What is my IP.” The IPv4 address is the result we need. - **Every location you manage CWP from.** If you log in from home and from an office, or if a developer or agency manages the server for you, include each public IP address in the same request. - **Your server hostname or primary domain.** This lets us identify the correct server quickly, especially if you have more than one. **Note:** Many home and mobile internet connections use a dynamic IP address that changes over time. If your CWP access stops working again later, check your public IP address and send us the new one. A static IP address from your internet provider, or a VPN with a fixed exit address, will avoid repeat requests. ### Where to send it The whole process takes a few minutes and does not require waiting for an agent: 1. Log in to your [Account Management Panel (AMP)](https://secure1.inmotionhosting.com/amp). 2. Start a new message with our team using the chat widget. 3. Enter your public IPv4 address, along with any other IPv4 addresses you connect from. 4. Submit the request. You do not need to stay in the chat afterward. 5. Follow along on our [Status page](https://status.inmotionhosting.com) for updates. **Important:** We handle allowlist requests in the order received. We cannot expedite individual requests. Submitting the same request more than once, or through another channel such as a support ticket or email, does not move it forward. Submit once, and we will confirm by email when your IP address has been added. ### If you have root SSH access This change does not affect SSH access. If you are comfortable managing your own server, you can allow your IP address yourself. Log in via SSH as root and run the following command, replacing the example address with your public IP address: ``` csf -a 203.0.113.10 ``` The rule takes effect immediately, and you can log in to CWP right away. Only add addresses you control. Do not re-open the CWP ports to all traffic in the CSF configuration, as that removes the protection this change provides. ## What Comes Next This CWP security precaution will stay in place while our investigation continues and until CWP provides a fix and we verify it on our servers. We will update this article as the situation develops. For live updates, visit [status.inmotionhosting.com](https://status.inmotionhosting.com). Your security and the integrity of your service are our top priority. Thank you for your patience while we work to keep your server protected.