PremiumComes with the add-on reqad-account. Installing add-ons

Signing in & security

How you sign in to the account panel, how to protect the account with two-factor authentication and passkeys, where to see and end the sessions, SSH keys and messages of your account, and what the malware scanner found in your files.

This page and the next ones describe the account panel on port 2083, as a hosting account sees it. Some parts may be missing from your menu: your hosting provider decides what the server and your package offer.

Open https://<your server>:2083/ and sign in with your account's user name and password. It is the same password as for SSH, SFTP and FTP. If you turned on two-factor authentication, the panel then asks for the 6-digit code from your authenticator app; a recovery code works too. With a passkey, Log in with a passkey needs neither.

Too many wrong passwords from one address block it for a while. Lost your password? The login page says whom to contact: your hosting provider sets a new one.

A session ends by itself after a while without use, and after some hours at the latest. Signing out, or being signed out, also closes the webmail, phpMyAdmin and terminal tabs opened from the panel.

Security > Password and 2FA

Password: change it with your current one. The new password is also your password for SSH, SFTP and FTP, at once. Other devices signed in to the panel are signed out; this one stays. Mailbox and database passwords do not change: each has its own. A contact address is needed first, so that you hear about a change you did not make.
Two-factor authentication: scan the QR code with an authenticator app (Google Authenticator, Microsoft Authenticator, Aegis, 1Password, Bitwarden...) and enter its code. You get recovery codes, shown only once: keep them in a password manager. Each one signs you in once if you lose your phone.
Passkeys: sign in with your fingerprint, face or device PIN. A passkey lives on your phone, computer or password manager and works only on this panel's address, so a look-alike site cannot use it. Passkeys are for the panel only; SSH, SFTP and FTP keep using your password.

Changes here ask for your password (and code) again when you last confirmed it more than a few minutes ago, and each change is mailed to your contact address.

Security > Active sessions

The browsers signed in to your panel now, with when and where they signed in and whether they used two-factor authentication or a passkey, and below them the recent sign-ins, the refused ones included. Sign out ends one; that browser has to sign in again. If you see something you do not know: sign it out, change your password right away, and turn on two-factor authentication.

Security > SSH access

The page says what your account may do over SSH: a normal shell, a shell that sees only your home folder, SFTP only (copy files, no commands), or nothing. It shows the server, port and user name to connect with, and whether the server takes passwords or only keys.

Add an SSH key: paste a public key (a line starting with ssh-ed25519, ssh-rsa or ecdsa-sha2-, or the block PuTTYgen shows) and give it a name, such as "Work laptop". The page shows how to make one on macOS, Linux and Windows (ssh-keygen or PuTTYgen). Never paste the private key.
The list is your ~/.ssh/authorized_keys file: keys added elsewhere show too, and lines that are not keys are kept as they are. If other users could change the folder or the file, SSH ignores your keys; Fix it sets the right permissions.
In FileZilla, WinSCP or Cyberduck, choose SFTP (not FTP) with the server, port and user name shown.

Security > Malware scan

Shown when your hosting provider scans the server for malware. It lists the files the scanner found infected in your account, each with its place in your home folder, the threat that matched and when it was found. Open folder opens that folder in the File manager. The page only shows what was found: it cannot start a scan or clean a file.

Delete files that should not be there, such as a PHP file in an uploads folder or one with a strange name.
Replace changed files with clean copies: install the plugin or theme again, or restore the file from a backup.
Then change your password (it is also your SSH and FTP password) and the passwords of your sites' administrators, and keep WordPress, its plugins and themes up to date: most infections come in through an old plugin.
A file you delete or fix leaves the list at the next scan. The page shows when your files were last scanned and when the server scans them.
Sure a file is safe? Ask your hosting provider: only they can mark it as safe.

While infected files are listed, your Home page shows them under Needs attention.

Profile: contact address and messages

Your Profile (the menu under your name) holds the address the panel writes to. Type it with your password; a 6-digit code is mailed to it, and it is used once you enter that code. Then choose what you are told about, each on or off:

Kind	When
Sign-ins from a new device	Someone signed in to your panel from a browser it has not seen before, or a database is open to any address on the internet.
Certificates	A site's certificate is about to expire, has expired or does not cover all its names.
Email setup	A mail domain is missing DNS records (MX, SPF, DKIM, DMARC), or a site that should have email has none.
Disk space	The account is close to its disk space limit.
Updates	WordPress updates are waiting, or a site runs a PHP version that no longer gets security fixes; also what WordPress auto-updates changed.
Cron jobs	A cron job failed 3 times in a row.
Resource limits	A site ran out of PHP workers several times in a day, or the memory limit stopped a process.
Deployments and apps	A deployment failed or an app stopped running.

A problem is sent once when it is first found, then at most once a week while it lasts. Everything is also on your Home page under Needs attention.

Password and two-factor changes are always told. The Profile page also sets light or dark (for this browser) and the panel's language and theme. Removing the contact address stops all messages, after one last one to the old address.

Need a hand? Create a free account or contact us.