PremiumComes with the add-on reqad-account. Installing add-ons

Signing in & security

How you sign in to the account panel, how to protect the account with two-factor authentication and passkeys, and where to see and end the sessions, SSH keys and messages of your account.

This page and the next ones describe the account panel on port 2083, as a hosting account sees it. Some parts may be missing from your menu: your hosting provider decides what the server and your package offer.

Open https://<your server>:2083/ and sign in with your account's user name and password. It is the same password as for SSH, SFTP and FTP. If you turned on two-factor authentication, the panel then asks for the 6-digit code from your authenticator app; a recovery code works too. With a passkey, Log in with a passkey needs neither.

Too many wrong passwords from one address block it for a while. Lost your password? The login page says whom to contact: your hosting provider sets a new one.

A session ends by itself after a while without use, and after some hours at the latest. Signing out, or being signed out, also closes the webmail, phpMyAdmin and terminal tabs opened from the panel.

Security > Password and 2FA

Password: change it with your current one. The new password is also your password for SSH, SFTP and FTP, at once. Other devices signed in to the panel are signed out; this one stays. Mailbox and database passwords do not change: each has its own. A contact address is needed first, so that you hear about a change you did not make.
Two-factor authentication: scan the QR code with an authenticator app (Google Authenticator, Microsoft Authenticator, Aegis, 1Password, Bitwarden...) and enter its code. You get recovery codes, shown only once: keep them in a password manager. Each one signs you in once if you lose your phone.
Passkeys: sign in with your fingerprint, face or device PIN. A passkey lives on your phone, computer or password manager and works only on this panel's address, so a look-alike site cannot use it. Passkeys are for the panel only; SSH, SFTP and FTP keep using your password.

Changes here ask for your password (and code) again when you last confirmed it more than a few minutes ago, and each change is mailed to your contact address.

Security > Active sessions

The browsers signed in to your panel now, with when and where they signed in and whether they used two-factor authentication or a passkey, and below them the recent sign-ins, the refused ones included. Sign out ends one; that browser has to sign in again. If you see something you do not know: sign it out, change your password right away, and turn on two-factor authentication.

Security > SSH access

The page says what your account may do over SSH: a normal shell, a shell that sees only your home folder, SFTP only (copy files, no commands), or nothing. It shows the server, port and user name to connect with, and whether the server takes passwords or only keys.

Add an SSH key: paste a public key (a line starting with ssh-ed25519, ssh-rsa or ecdsa-sha2-, or the block PuTTYgen shows) and give it a name, such as "Work laptop". The page shows how to make one on macOS, Linux and Windows (ssh-keygen or PuTTYgen). Never paste the private key.
The list is your ~/.ssh/authorized_keys file: keys added elsewhere show too, and lines that are not keys are kept as they are. If other users could change the folder or the file, SSH ignores your keys; Fix it sets the right permissions.
In FileZilla, WinSCP or Cyberduck, choose SFTP (not FTP) with the server, port and user name shown.

Profile: contact address and messages

Your Profile (the menu under your name) holds the address the panel writes to. Type it with your password; a 6-digit code is mailed to it, and it is used once you enter that code. Then choose what you are told about, each on or off:

Kind	When
Sign-ins from a new device	Someone signed in to your panel from a browser it has not seen before, or a database is open to any address on the internet.
Certificates	A site's certificate is about to expire, has expired or does not cover all its names.
Email setup	A mail domain is missing DNS records (MX, SPF, DKIM, DMARC), or a site that should have email has none.
Disk space	The account is close to its disk space limit.
Updates	WordPress updates are waiting, or a site runs a PHP version that no longer gets security fixes; also what WordPress auto-updates changed.
Cron jobs	A cron job failed 3 times in a row.
Deployments and apps	A deployment failed or an app stopped running.

A problem is sent once when it is first found, then at most once a week while it lasts. Everything is also on your Home page under Needs attention.

Password and two-factor changes are always told. The Profile page also sets light or dark (for this browser) and the panel's language and theme. Removing the contact address stops all messages, after one last one to the old address.

Need a hand? Create a free account or contact us.