Port reference
Port 2087 (TCP) – WHM (WebHost Manager, TLS)
TLS web port for WHM, the server-level administration panel for cPanel hosting (root/reseller control).
Quick facts
- Transport
- tcp
- Category
- Registered
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open on cPanel servers running WHM; serves HTTPS, with the non-TLS variant on 2086.
What is port 2087 used for?
Port 2087 is the secure (TLS/HTTPS) web port for WHM (WebHost Manager), the server-level control panel that ships with cPanel hosting. Administrators and resellers open WHM in a browser to create and manage hosting accounts, configure services, and run the whole server, while end users manage a single site through cPanel. The plain (non-TLS) version of WHM listens on port 2086.
When would you open it?
You open or forward 2087 only if you run a cPanel/WHM server and need to reach the WHM admin interface over HTTPS. Most providers reach it directly by visiting https://yourserver:2087, so you would allow it on the server's firewall for the people who administer the box.
Is it safe to open?
WHM gives near-total control of the server, so leaving it open to the whole internet invites brute-force and exploitation. Restrict it to trusted IPs or a VPN, enable two-factor login, and keep cPanel updated. See the security notes below.
How to check if this port is open
ss -tulpn | grep :2087
nmap -p 2087 <target>netstat -ano | findstr :2087
Test-NetConnection <host> -Port 2087lsof -i :2087
nmap -p 2087 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 2087 to your device's local IP, internal port 2087, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 2087/tcpsudo firewall-cmd --permanent --add-port=2087/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 2087 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 2087" -Direction Inbound -Protocol TCP -LocalPort 2087 -Action AllowSecurity & risks
Common attacks
- Credential brute force and password spraying against the root/reseller login
- Exploitation of repeated cPanel/WHM vulnerabilities (auth bypass, XSS, RCE)
- Mass automated scanning of hosting servers for exposed WHM panels
- Privilege abuse after account or reseller compromise
Hardening
- Restrict WHM access to allowlisted IPs / VPN rather than the open internet
- Enforce strong unique root/reseller passwords, MFA, and cPHulk protection
- Replace the default certificate and keep cPanel & WHM patched
- Apply least privilege to reseller accounts and disable unused features
- Monitor logins and audit reseller/account activity
How to block this port
sudo ufw deny 2087/tcpsudo firewall-cmd --permanent --remove-port=2087/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 2087 -j DROPNew-NetFirewallRule -DisplayName "Block 2087" -Direction Inbound -Protocol TCP -LocalPort 2087 -Action Blocknmap snippet
nmap -p2087 --script ssl-cert,http-title,http-auth <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- What is port 2087 used for?
- It is the TLS port for WHM (WebHost Manager), the server-level control panel that administers a cPanel server — creating accounts, managing services, and configuring the host with root or reseller privileges. The non-TLS variant is 2086.
- Is it safe to expose port 2087 to the internet?
- No. WHM grants root/reseller control of an entire hosting server and is a constant brute-force and CVE target. Restrict 2087 to allowlisted IPs or a VPN, enforce MFA and cPHulk, replace the default certificate, and keep WHM patched.