The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Creating an SSH/SFTP login on agency hosting depends on the control panel and the permissions your hosting provider exposes. In Plesk for Linux, you normally enable SSH for the domain’s existing website system user under Websites & Domains → Hosting & DNS → Hosting. In cPanel, you need an SSH-capable account; a user created only in FTP Accounts cannot log in through SFTP. Start by identifying the panel, confirming that SSH is allowed, and asking the provider which account, host, port and authentication method your collaborator should use.
Give the narrowest access that completes the work. Prefer a chrooted shell or a provider’s restricted-SFTP feature, use an SSH key when supported, send connection details securely, test the login, and revoke access when the engagement ends.
As an Amazon Associate I earn from qualifying purchases.
Choose the correct workflow before creating anything
“Agency hosting” is a service arrangement, not a single technical platform. The agency may manage a Plesk subscription, a cPanel account, or a host-specific dashboard with different limits. A safe setup therefore begins with four questions:
Free tools Windows power users keep installed
One-click scans. No signup required.
- Which panel and operating system are in use? The menu names below apply to Plesk for Linux and cPanel; a managed dashboard may require the provider to make the change.
- Does the plan permit SSH? Providers can disable shell access even when the panel has SSH-related menus.
- Which identity should the collaborator use? Plesk’s documented domain workflow uses the website’s system user. cPanel requires an account that has SSH access; an FTP-only account is not enough for SFTP.
- What scope is actually needed? A deployment may need access to one website, while troubleshooting could require commands. Choose a restricted shell or SFTP-only option if the host offers one.
| Question | Plesk for Linux | cPanel |
|---|---|---|
| Typical account used | The subscription or domain’s website system user | An SSH-capable hosting account; the cPanel login may be used if the provider permits it |
| Can an FTP-only user use SFTP? | Not the documented domain workflow | No. FTP Accounts users cannot authenticate to SFTP |
| Who controls availability? | Administrator, service plan and provider configuration | Hosting provider can disable shell access |
| Scope controls | Shell selection, including chrooted Bash where available | Provider-specific shell and account permissions |
| Port | Provider’s configured SSH port | Often 22 in documentation examples, but the provider’s port is authoritative |
What SSH and SFTP access actually provide
SSH is the encrypted service used for an interactive command-line session. SFTP is a file-transfer protocol that runs through SSH; it is not FTP with an “S” added and it does not automatically work for every FTP account. The same server, port and authentication policy may support both, but the hosting account must be authorized for SSH/SFTP.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Access can expose more than the website’s public files. A shell may allow directory listing, log inspection, version-control commands, archive creation and other operations permitted to that Unix user. File permissions still limit what the account can read or change, but a less restricted shell can make more of the server visible. Treat a collaborator’s SSH credential as a production credential, not as a disposable upload password.
Prepare the access request with your hosting provider
Identify the panel and subscription
Ask the agency or host for the panel name, the domain or subscription that should be accessed, and whether the account is on Linux. In Plesk, shell choices and the menu path described here are Linux features. If the panel is hidden behind a managed service, request the change from support rather than guessing at a different account.
Confirm the provider’s policy
Ask whether SSH is enabled on the plan, which port is open, whether password authentication is allowed, and whether public-key authentication is supported. Also ask whether the service has a separate restricted-SFTP user feature. Plesk’s documented domain workflow does not create a login for an arbitrary directory, and panel capabilities can differ by version and hosting configuration.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesDefine the collaborator’s task
Write down whether the person needs file transfer only, an interactive shell, scheduled-task maintenance, database commands or deployment tooling. That decision determines whether SFTP-only access is sufficient or whether a shell is necessary. Do not grant root access or share the agency’s main administrator credential for routine website work.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Create access for a Plesk website system user
Plesk’s documented workflow changes the shell assigned to the website’s existing system user. Plesk Support states that “Only the system user of a Subscription or Domain can receive SSH access” in the workflow described in its support article, updated June 24, 2025. This does not mean every current Plesk service has no additional SFTP-user feature; ask the provider to confirm what your installation supports.
- Sign in with sufficient rights. You need a Plesk role that can edit the subscription’s hosting settings. If the SSH field is missing or read-only, the administrator or provider controls it.
- Open the domain’s hosting settings. Go to Websites & Domains, locate the domain, then choose Hosting & DNS → Hosting.
- Find SSH access. Set SSH access to an option other than Forbidden. The available shell names depend on the Plesk installation.
- Select the least-permissive suitable shell. Use a chrooted shell when the collaborator only needs the website environment. Select a broader shell only when a documented task requires it and the provider approves the exposure.
- Save the hosting settings. Plesk applies the shell assignment to the website system user.
- Retrieve the account details. Open Connection Info to see the server IP and the website system-user name. Obtain the hostname, SSH port and authentication instructions from the provider if they are not shown there.
- Give the collaborator only the approved details. Share the username, hostname or IP, port and either the temporary password or key-based instructions through a secure channel.
Understand Plesk shell choices
| Shell choice | What it means | When to use it |
|---|---|---|
| Forbidden | No new SSH or SFTP sessions for the system user | Default when no remote access is required, or after work ends |
| /bin/bash (chrooted) | The website home directory appears as / for that session; the user is restricted to the chroot environment, subject to permissions |
Preferred starting point for website file work and commands that run inside the site |
| Non-chrooted shell | The session sees a larger portion of the server filesystem, while Unix permissions still restrict operations | Only when a specific task needs it and the provider confirms the consequences |
Chrooting is a boundary, not a substitute for file permissions or careful command use. Some tools expect paths, libraries or sockets outside the website home and may fail in a chroot. If a deployment script needs such resources, ask the provider whether it can be adapted or run by a controlled service account instead of immediately widening the shell.
Review scheduled tasks before changing a Plesk shell
Plesk warns that switching between chrooted and non-chrooted SSH access changes the root directory seen by scheduled tasks. A task that previously used a path relative to the website root can behave differently after the change. Before saving a broader shell:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- List the subscription’s scheduled tasks and record their commands, working directories and interpreter paths.
- Check scripts for absolute paths such as
/var/www, home-directory references and binaries that may not exist inside a chroot. - Test a task in a maintenance window and inspect its output or logs.
- Document the original shell so it can be restored after the collaborator finishes.
When access is revoked by returning SSH access to Forbidden, new sessions are prevented, but existing sessions remain open until they close. Ask the collaborator to disconnect and terminate any persistent process or tunnel that should no longer run.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Apply access at the Plesk service-plan level only when the scope is intentional
An administrator can set SSH access under Service Plans → select the plan → Hosting Parameters. This is a plan-wide policy, not a convenient shortcut for one contractor. If the plan change is propagated to existing subscriptions, Plesk uses its permissions and Update & Sync workflow to determine what is synchronized.
Use this route only when every affected subscription should receive the same SSH policy. For one website, change the domain-level hosting setting instead. Before synchronizing, identify subscriptions that have custom settings, review scheduled tasks, and make sure the selected shell is appropriate for all of them. A provider-managed plan may prevent you from changing this parameter at all.
Set up SSH/SFTP access in cPanel
cPanel’s exact controls vary because the hosting provider can disable shell access. The important distinction is between an SSH-capable hosting account and a user created only for FTP.
When the provider enables shell access
- Ask the provider to enable SSH. If the feature is absent, support must confirm whether the plan allows it and which account should connect.
- Use the approved account. Follow the host’s instructions for the cPanel account or another SSH-enabled user. Do not assume that creating a new entry in FTP Accounts creates a Unix SSH identity.
- Collect connection values. Record the server hostname or IP, SSH port, username and the permitted authentication method. cPanel documentation commonly demonstrates port
22, but your host may use a different port. - Test with the provider’s shell restrictions. A successful SFTP transfer does not prove that interactive shell commands are enabled, and a shell login may be limited by the account’s jail or permissions.
Why an FTP account fails with SFTP
An FTP account is an FTP credential. SFTP authenticates through the SSH service and expects an SSH-authorized operating-system account or provider-created restricted identity. If an FTP user receives “authentication failed” in an SFTP client, creating the same username again usually does not solve the problem. Ask the host for an SSH-capable account or a supported restricted-SFTP feature instead.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Prefer an SSH key when the host supports it
Public-key authentication avoids sending a reusable password to the collaborator and allows the provider to revoke one key without changing a shared account password. The private key must remain on the collaborator’s computer; only the public key is installed on the hosting account.
- Create a key pair locally. The collaborator can use the operating system’s OpenSSH tools or an approved key manager. A modern, provider-supported key type such as Ed25519 is a common choice; follow the host’s accepted algorithms.
- Protect the private key. Store it in the local SSH directory, set a passphrase, and do not email or upload it to the hosting provider. The person who will connect should be the only person with access to the private key.
- Enable the host’s limited SSH mode first. In the Plesk key-based workflow, limited SSH access is enabled before adding the key.
- Open the key-management page. If the Plesk installation does not already expose it, the administrator may need to install the SSH Keys Manager extension. Add the collaborator’s public key under the domain’s SSH Keys page.
- Test key authentication. Use the correct username, hostname and port. If the host still requests a password, confirm that the key was added to the same system user and that the provider allows key authentication.
- Revoke the key when work ends. Remove that public key from the hosting account, then close active sessions and rotate any temporary password that was also issued.
Never ask a collaborator to send you their private key so you can install it. The public key is designed to be shared; the private key is not.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Give the collaborator a complete connection checklist
Send these fields through a secure channel, separately from any sensitive secret when practical:
- Protocol: SSH for a shell or SFTP for file transfer.
- Hostname or server IP: Use the provider’s value, not automatically the website’s DNS name.
- Port: The provider’s configured SSH port;
22is only a common example. - SSH username: The Plesk website system user or the cPanel-approved SSH identity.
- Authentication: Password instructions, or the local path to the private key and its passphrase.
- Initial directory: Tell the collaborator what directory represents the website root if the panel’s chroot makes it appear as
/. - Scope and expiry: State which site may be changed and when access will be removed.
Example command-line tests
After confirming the actual host and port, an SSH test has this form:
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
ssh -p PORT USERNAME@HOSTNAMEAn SFTP test uses an uppercase -P for the port:
sftp -P PORT USERNAME@HOSTNAMEReplace the capitalized values with the provider’s details. Do not treat a successful connection as permission to browse unrelated subscriptions; remain within the agreed scope.
Troubleshoot the common failure modes
“Connection refused” or a timeout
Verify the hostname, port and network restrictions first. The provider may have disabled SSH, allowlisted only certain IP addresses, or configured a nonstandard port. An incorrect port can look like a server outage. Ask support whether a firewall, VPN requirement or maintenance window is blocking the connection.
“Permission denied” with the correct password
Confirm that the username is the SSH identity, not an FTP-only username. Check whether password login is disabled in favor of keys, whether the account is locked, and whether the shell is still set to Forbidden. In Plesk, verify the domain’s hosting setting and the system-user name shown in Connection Info.
The key is rejected
Make sure the public key was installed for the same account used in the client, copied without line breaks being altered, and accepted by the provider’s algorithm policy. Confirm that the private key matches the installed public key and that the client is actually offering it. A passphrase protects the key locally; it is not the same as the hosting account password.
SFTP works but shell commands do not
The account may be restricted to file transfer, or its shell may be a jailed environment that omits the requested binary. Ask the provider whether interactive SSH is permitted and which commands are supported. Do not switch to a non-chrooted shell merely to make one script work without checking its path and security implications.
Files appear in the wrong place
In a chrooted Plesk session, the website home directory is presented as /. A path that is absolute from the server administrator’s perspective may be invalid inside the session. Start with pwd, list the visible directories, and use the hosting provider’s documented website-root path. Avoid changing ownership or permissions unless the provider explicitly instructs you.
A scheduled task stops working after the change
Review the task’s interpreter, working directory and absolute paths. The root-directory change associated with chrooted versus non-chrooted access can invalidate an otherwise correct command. Restore the prior shell if appropriate, then test a corrected task under the intended setting.
Quick Recap
Security and offboarding checklist
- Use a separate named identity for each collaborator whenever the provider supports it; do not share the agency’s administrator login.
- Grant only the shell or SFTP capability required for the task.
- Prefer a chrooted shell or restricted-SFTP feature over broad filesystem visibility.
- Prefer a passphrase-protected SSH key and keep its private half off the server.
- Record the hostname, port, username, key fingerprint or password owner, granted scope and expiry date.
- Test access using a non-destructive command or a small transfer before production changes.
- Remove the public key, disable SSH or delete the temporary account when work ends.
- Close active sessions and stop long-running tunnels or deployment processes.
- Review scheduled tasks after any shell change.
- Ask the provider to confirm whether logs, IP allowlists, two-factor authentication or additional restrictions are available on the plan.
Decision guide: which option should an agency choose?
| Need | Recommended starting point | Reason |
|---|---|---|
| Upload or download website files only | Restricted SFTP identity, if the host offers one | Avoids granting an interactive shell |
| Run deployment commands inside one site | Plesk system user with /bin/bash (chrooted), or the cPanel provider’s least-privileged SSH account |
Provides commands while limiting filesystem visibility |
| Maintain tasks that require server-level paths | Provider-reviewed non-chrooted or specialized service account | Broader visibility may be required, but scheduled-task paths must be reviewed |
| One-time contractor access | Key-based access with a documented expiry and immediate revocation | Limits credential reuse and simplifies offboarding |
| Panel does not show SSH controls | Provider support request | Availability and account creation may be controlled outside the customer panel |
Final verification before handing over access
- Identify whether the account is Plesk, cPanel or a managed alternative.
- Confirm that the plan permits SSH/SFTP and obtain the provider’s hostname and port.
- Use the correct identity: Plesk’s website system user or a provider-approved SSH account, never an FTP-only login for SFTP.
- Select the narrowest shell or transfer-only option that meets the task.
- Review scheduled tasks before changing chroot status.
- Install a public key when supported, keeping the private key with its owner.
- Test SSH or SFTP, verify the visible directory and perform a harmless transfer or command.
- Document the access and remove it, close sessions and revoke keys when the work is complete.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
