The control panel connections are secured too.
WEBMAIL
Reached at yourdomain.com/webmail once the domain resolves and AutoSSL has issued. The connection uses your domain's certificate.
Before the certificate exists, use the server hostname from your welcome email to avoid a warning.
CPANEL
yourdomain.com/cpanel or the server hostname on the secure port. Both are encrypted.
If you see a certificate warning reaching cPanel by domain name, AutoSSL has not covered it yet. Use the server hostname meanwhile.
WHY THIS MATTERS
You enter your cPanel password on these pages. An unencrypted or unverified connection exposes it.
Never dismiss a certificate warning on a login page. If the certificate is wrong, find out why before entering credentials.
THE SAFEST ROUTE
Log in to cPanel through the Client Area, using Services > My Services > Login to cPanel. That signs you in directly without entering the password at all.
FTP
Use FTP over TLS rather than plain FTP, which sends credentials unencrypted.
