How to Fix Email Accounts Missing from cPanel

You open Email Accounts in cPanel and some mailboxes are gone, or the list is empty. Users cannot log in to webmail or their mail app. Yet the mail itself is still on the server, in /home/USER/mail/DOMAIN/.

This happens when the files that list a domain's mailboxes are damaged or emptied. The messages are not touched, so the fix is to put those files back. This guide shows how.

Quick answer

For the cPanel user USER and the domain example.com:

1. Restore these two files from a backup:

   /home/USER/etc/example.com/shadow
   /home/USER/etc/example.com/passwd
   

2. If the accounts still do not show, move the cached list aside:

   mv /home/USER/.cpanel/email_accounts.json /home/USER/.cpanel/email_accounts.json.backup
   

3. Reset the password of each account you brought back.

No backup? Recreate the missing accounts in cPanel instead. Their mail is kept. cPanel

What you need: root SSH access (or the hosting provider's help), and ideally a backup of the cPanel account.

Why it happens

Each domain in a cPanel account has its own folder in /home/USER/etc/. Two files there list its email accounts:

• passwd: the mailbox names and where their mail is stored.
• shadow: the password of each mailbox, stored as a hash.

If a line goes missing from these files, cPanel no longer knows that mailbox exists. Malware on a hacked website is a common cause, because it can write to files in the account's home folder. cPanel

cPanel also keeps a cached list of email accounts in /home/USER/.cpanel/email_accounts.json, which can still show the old, wrong list after the files are fixed.

Before you start: make a copy

Copy the current files first, so you can undo anything:

cp -a /home/USER/etc/example.com /root/example.com-etc-before-fix

Replace USER with the cPanel username and example.com with the domain throughout this guide.

Fix 1: Restore the files from a backup (best)

Restoring the whole cPanel account from a backup is the simplest fix, but it also rolls back the website, databases and mail to the date of the backup. cPanel

To bring back only the mailbox list, take just the two files from the backup:

1. Find the newest backup that has the missing accounts (for example in WHM › Backup Restoration, or in your backup tool such as JetBackup or Acronis).
2. Extract homedir/etc/example.com/shadow and homedir/etc/example.com/passwd from it.
3. Copy them over the current files in /home/USER/etc/example.com/.
4. Make sure the restored files have the same owner and permissions as before (compare with your copy in /root/example.com-etc-before-fix).

The restored shadow file brings back the passwords from the date of the backup.

Fix 2: No backup? Recreate the accounts

If there is no backup, recreate each missing account in cPanel › Email › Email Accounts › Create, using exactly the same address. The messages already in its mail folder are kept. cPanel

If cPanel says the account already exists, edit the files by hand instead, as cPanel describes: cPanel

1. Open /home/USER/etc/example.com/passwd with vi.
2. Copy the line of an account that still works, paste it as a new line, and change the mailbox name (the text before the first :) and any path in it to the missing account's name.
3. Do the same in /home/USER/etc/example.com/shadow, and change a few characters of the password hash, so the new account does not share the copied account's password.
4. Reset the new account's password afterwards (Fix 4), because the edited hash is not a usable password.

Fix 3: Clear the cached account list

If the accounts still do not appear after Fix 1 or 2, move the cached list aside. cPanel builds a new one the next time you open Email Accounts. cPanel

mv /home/USER/.cpanel/email_accounts.json /home/USER/.cpanel/email_accounts.json.backup

Fix 4: Reset the passwords

Set a new password for each account you brought back by hand. In cPanel, go to Email › Email Accounts, click Manage next to the account, and set a new password. From the command line, as root: cPanel

uapi --user=USER Email passwd_pop email='info@example.com' password='A-New-Strong-Password'

Do this for accounts restored from a backup too if the site was hacked, because the old passwords may be known to the attacker.

Check it worked

1. Open cPanel › Email › Email Accounts. All accounts should be listed.
2. Log in to webmail with one of them. The old messages should be there.
3. Send a test email to it from an outside address, and check that it arrives.

If it happens again

Mailboxes that disappear more than once usually mean the account is compromised: something on the website keeps changing these files. cPanel

• Scan the account for malware, for example with ImunifyAV or Imunify360.
• Update or remove outdated WordPress plugins and themes.
• Change the cPanel password and all email passwords.
• If you cannot find the cause, restore the account from a clean backup and ask a security specialist to check it. cPanel