That would mean somebody could simply sniff my password with Wireshark for example, right?

Wow, since ever I started researching security I'm really shocked how transparent we actually are and how weak these systems are. It does not even matter how hard you construct your passwords, if the system is weak somebody will easily get it.

To my question:
To avoid somebody sniffing my CPanel password, I'd simply have to use VPN so it's encrypted right?

... what a transparent world we're living in.

Just contacted the support and found out they have a https version as well, wish it was visible in the interface, so I could have changed it to that from the beginning on.

To wrap things up: When you don't use https, your password could be sniffed.

and even if u use a tunnel/vpn, the traffic is encrypted only till vpn, fhrom there to server its unencrypted. if they provide https service, thats much better

on one of my servers the https for cpanel doesn't work

so http://domain.tld/cpanel works fine, but https://domain.tld/cpanel says:

SSL received a record that exceeded the maximum permissible length.
(Error code: ssl_error_rx_record_too_long)

Do I need to activate something in WHM in order to get the https working again?

I think the reason hosting providers give this link is because some people may have the secured port blocked by their firewall and might cause some confusion. Nonetheless, I wish they would give the secured link anyway!!

Just approached the assistance and discovered out they have a https edition as well, wish it was noticeable in the program, so I could have modified it to that from the starting on.