# Why webmail cannot reset your password
Source: https://docs.webgee.com/en/email/understanding-the-disabled-reset-password-functionality-in-cpanel-webmail



The **Reset Password** option in cPanel webmail — the one that emails a recovery
link to a secondary address — is disabled on WebGee servers. Applies to shared,
reseller and cPanel hosting.

## Reset a password instead [#reset-a-password-instead]

Use cPanel:

1. Open **Email Accounts**.
2. Select **Manage** beside the address.
3. Set a new password and select **Update Email Settings**.

The full procedure is in
[Change a mailbox password or quota](/en/email/how-to-change-your-email-account-password-or-mailbox-quota-in-cpanel).

If you cannot reach cPanel either, contact support.

## Why it is disabled [#why-it-is-disabled]

The feature was removed in response to the **AnonymousFox** family of attacks,
which exploit outdated or vulnerable WordPress plugins to gain access to an
account's file system.

Once an attacker can read files in a hosting account, they can read the mail
stored in it. Webmail's password reset works by *sending the new password to a
mailbox* — and if that mailbox is on the same server, the attacker reads the
reset message and gains an authenticated login. A file-system foothold becomes a
working credential.

Disabling the feature removes that step.

<Callout type="info">
  This was never a server-level compromise. WebGee runs CageFS, which isolates
  each account's file system, so an exploit of this kind cannot reach other
  accounts on the same server.
</Callout>

## What this means for you [#what-this-means-for-you]

The underlying risk is the vulnerable plugin, not the reset feature. Disabling
the reset closes one route in; keeping your applications patched closes the
door itself.

* Keep WordPress core, themes and plugins up to date.
* Remove plugins and themes you do not use — inactive code is still code on
  disk.
* Use a distinct password for each mailbox.

## Related [#related]

* [Change a mailbox password or quota](/en/email/how-to-change-your-email-account-password-or-mailbox-quota-in-cpanel)
* [Fix "550 5.7.1 \[ESA\] Sender Blocked"](/en/email/understanding-and-resolving-the-550-5-7-1-esa-sender-blocked-error)