Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Short answer: You do not create an SSH/SFTP login the same way on every agency host. First identify whether the account uses Plesk, cPanel, or a provider-specific dashboard, then ask the host which account is permitted and whether SSH is enabled. In Plesk for Linux, SSH or SFTP is normally granted to the domain’s website system user under Websites & Domains > Hosting & DNS > Hosting. In cPanel, the provider may disable shell access, and a user created in FTP Accounts cannot log in through SFTP. Use the narrowest shell and authentication method that meets the collaborator’s task, test the connection, and revoke access when the work is finished.
This guide covers the documented Plesk workflow, the important cPanel limitations, key-based authentication, connection details, troubleshooting, and safe removal. Plesk menus and available shells vary by Linux version and hosting configuration, so the provider’s current interface is authoritative.
SSH and SFTP are related, but they are not the same login type
SSH (Secure Shell) provides an authenticated command-line session on a server. SFTP means SSH File Transfer Protocol: it transfers files through the SSH service. SFTP is not an FTP account with an extra security switch, and it is not a separate protocol that automatically appears when an FTP user is created.
Recommended Free Tools
Both services normally use the same SSH username, host, port, and authentication method. A collaborator who only needs to upload or download files may use an SFTP client, while a developer who must run commands may need an interactive SSH shell. Giving shell access to someone who only needs file transfer expands the potential impact of a compromised credential, so agree on the actual task before enabling anything.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Start by identifying the hosting panel and account
Agency hosting is often managed on behalf of several client sites. The person who administers the hosting may be able to change a shell setting, while the agency collaborator can only use the resulting credentials. Do not assume that you need to create a new Unix account, share the main cPanel login, or grant administrator access.
Confirm these details with the host
- Which control panel manages the site: Plesk, cPanel, or a provider-specific dashboard?
- Does the hosting plan permit SSH and SFTP, and has the provider disabled shell access for this account?
- Which account should the collaborator use: the Plesk website system user, an SSH-capable cPanel account, or another provider-approved identity?
- What hostname or IP address and SSH port should be used? Port 22 is common, but the provider’s configured port takes precedence.
- Does the host permit password authentication, public-key authentication, or both?
- Is a restricted SFTP-only account available if the collaborator must access one directory rather than the whole website home?
Plesk Support’s documented workflow describes access for the subscription or domain system user. A Plesk Support article updated June 24, 2025 states: “Only the system user of a Subscription or Domain can receive SSH access.” Treat that as the scope of that documented workflow, not as a guarantee that every current Plesk service lacks other account features. Ask the provider about any newer, separately documented restricted-SFTP option.
Panel differences at a glance
| Question | Plesk for Linux | cPanel |
|---|---|---|
| Which identity is used? | The website’s subscription or domain system user in the documented domain-level workflow. | An account with SSH access enabled by the host or administrator. |
| Can an FTP user use SFTP? | Not implied by creating an FTP user; use the account authorized for SSH. | No. A user created under FTP Accounts cannot connect through SFTP. |
| Who controls availability? | The administrator, service plan, and provider configuration determine the setting. | The provider can disable shell access entirely. |
| How is scope restricted? | /bin/bash (chrooted) confines the website system user to its website home in the documented setup. |
Restrictions depend on the account, shell policy, and provider configuration. |
| What port is used? | Use the port shown or supplied by the provider. | cPanel documentation commonly illustrates port 22, but the provider’s port is authoritative. |
Grant SSH or SFTP access in Plesk
The following procedure applies to a Plesk installation where you can manage the domain’s hosting settings. If a menu or shell choice is missing, the service plan or provider has probably restricted your permissions.
1. Open the domain’s hosting settings
- Sign in to Plesk with the account that manages the site.
- Open Websites & Domains.
- Find the required domain and select Hosting & DNS > Hosting.
- Locate SSH access. Set it to an option other than Forbidden.
- Choose the least permissive shell that supports the collaborator’s task, then save the change.
Plesk’s Connection Info view shows the server IP address and the website system-user name. Record those values rather than guessing the username from the domain name.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
2. Choose a shell deliberately
Plesk describes /bin/bash (chrooted) as restricting the website system user to the website home directory. Inside that session, the website home appears as the root of the restricted environment, which limits what the user can see even though the login is still an SSH login. This is generally the right starting point for a collaborator working on one site.
Other shell choices expose a larger portion of the server’s filesystem. Operating-system permissions still determine which files can actually be read or changed, but a broader view increases the consequences of a stolen credential or an accidental command. Do not select an unrestricted shell merely because it is familiar; establish why the collaborator needs it.
3. Check scheduled tasks before changing the shell
Plesk warns that moving between chrooted and non-chrooted SSH access changes the root directory seen by scheduled tasks. A task that previously used a path relative to the website home may resolve a different path after the change. Before switching shells, inspect the domain’s scheduled tasks, scripts, working directories, and any hard-coded paths. After saving the new shell, run an approved task or review its next execution to confirm that it still reaches the intended files.
4. Understand the directory limitation
In the documented Plesk domain workflow, SSH access is assigned to the subscription or domain system user; it is not a control for granting that user access to an arbitrary, specific directory. If the collaborator needs only a subdirectory, ask the provider whether the current service offers a separate restricted-SFTP feature. Do not promise directory-only isolation based solely on the standard SSH access selector.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Apply SSH access at the Plesk service-plan level
Administrators who manage multiple subscriptions can set the default under Service Plans > select the plan > Hosting Parameters. This is a broader change than editing one domain. Decide whether the setting should affect new subscriptions, existing subscriptions, or both.
Propagate a plan change only when the scope is intended
- Open the relevant service plan and change its SSH access parameter.
- Review the plan permissions and the subscriptions attached to it.
- Use the plan’s Update & Sync workflow only after confirming that every selected subscription should receive the change.
- Check an affected domain’s hosting page and verify the resulting shell.
Changing a service plan can grant or remove access for many sites at once. For a single agency collaborator, a domain-level change is safer and easier to audit.
Set up an SSH-capable account in cPanel
cPanel hosting is provider-controlled. Some hosts expose an SSH Access feature to an account owner; others disable shell access at the server or package level. If the feature is absent, greyed out, or produces a permission error, contact the provider rather than trying to bypass the restriction.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Do not use an FTP Accounts login for SFTP
cPanel’s documentation explicitly distinguishes FTP accounts from SSH users: an account created in FTP Accounts cannot be used to connect with SFTP. Creating an FTP login and entering it into an SFTP client will typically produce an authentication failure even when the password is correct.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Ask the provider which cPanel identity is approved for SSH. Depending on the plan, that may be the main hosting account or another account configured with shell access. Sharing the primary cPanel password gives more authority than a collaborator normally needs, so request a separate, limited identity when the host supports one.
Verify the provider’s SSH policy
- Confirm that shell access is enabled for the account and that outbound or inbound network restrictions do not block the SSH port.
- Obtain the exact SSH username; an FTP username, email address, or cPanel display name may not be valid.
- Ask whether the account is jailed, chrooted, or otherwise restricted, and which directories it can reach.
- Confirm whether the provider accepts an authorized public key and whether password login is disabled.
Prefer an SSH key when the host supports it
Public-key authentication avoids sending a reusable password for every login. The collaborator creates a key pair locally: a private key remains on the collaborator’s computer, and the matching public key is installed on the hosting account. The private key must never be emailed to the provider, uploaded to the website, or shared with another collaborator.
Plesk key-based workflow
- Enable limited SSH access for the domain system user, using the shell appropriate to the task.
- On the collaborator’s computer, generate an SSH key pair with the operating system’s SSH tools. Protect the private key with a passphrase.
- In Plesk, install the SSH Keys Manager extension if the hosting administrator has not already provided it.
- Open the domain’s SSH Keys page and add or authorize the collaborator’s public key.
- Give the collaborator the hostname, port, username, and the local path to the private key. Do not send the private key itself.
- Test a login and remove or revoke the public key when the assignment ends.
Key hygiene for agency work
- Use one key per person or automation task so that one departure does not require replacing everyone’s credentials.
- Label keys with an owner and purpose in the panel, if the interface supports comments.
- Keep the private key outside public web directories and protect the computer account that stores it.
- Use a passphrase and an approved agent or operating-system key store rather than placing the passphrase in scripts.
- Remove an old public key promptly when a contractor, agency, or device no longer needs access.
Give the collaborator complete connection details
An SFTP client cannot infer the correct account from a website URL. Send the following fields through an approved secure channel:
| Field | What to provide |
|---|---|
| Host | The provider’s SSH hostname or server IP address. |
| Port | The configured SSH port. Use 22 only when the host confirms it. |
| Username | The Plesk system user or provider-approved cPanel SSH user, not an FTP-only username. |
| Authentication | An approved password, or the local path to the collaborator’s private key and its passphrase. |
| Remote starting directory | The home or website directory shown by the host; a chrooted session may display that directory as /. |
For a command-line test, an SSH client uses the host, port, and username in a form such as ssh -p 22 agencyuser@server.example. An SFTP client uses the same identity and port; command-line SFTP commonly uses sftp -P 22 agencyuser@server.example. Replace the example values with those supplied by the provider. Graphical clients expose the same fields as separate connection boxes.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Test the least risky operation first
- Connect once with the agreed credentials or private key.
- Confirm the username shown by the session and note the starting directory.
- List the expected website files without changing anything.
- Upload a harmless test file only if the task requires write access, then remove it.
- For SSH access, run only a non-destructive command approved by the site owner.
- Record the result and close the session.
A successful connection proves authentication, not that the user can safely perform every task. Check read, write, and directory permissions against the actual work request.
Troubleshoot common failures
“Connection refused” or a timeout
- Verify the hostname or IP address and the port character-for-character.
- Ask whether the provider has enabled SSH for the plan and whether a firewall allows the source network.
- Do not assume port 22; managed agency hosts often use another configured port.
“Permission denied” with a correct password
- Confirm that the username is the SSH-capable identity, not an FTP Accounts username.
- Check whether password login is disabled and a public key is required.
- For key login, verify that the public key is authorized on the correct domain or account and that the collaborator is selecting the matching private key.
- Ask the provider whether the account is locked, expired, or restricted by an IP policy.
The Plesk SSH selector is missing or cannot be saved
The service plan or administrator permissions may prohibit customer-controlled SSH. Contact the host with the domain name and the collaborator’s required task. The provider may need to enable the feature, change the plan, or create a separate managed account.
The login works but files are not visible
A chrooted Plesk session presents the website home as the session root, so the path may look different from an administrator’s server path. Confirm the starting directory and use paths relative to that environment. If the collaborator cannot reach a required directory, ask the host to verify permissions and whether the requested location lies outside the account’s allowed scope.
Scheduled tasks fail after a shell change
Recheck task paths and working directories. A switch to or from non-chrooted access can change how a scheduled task resolves its root. Restore the previous shell if necessary, then coordinate a path correction with the site administrator.
Disabling access does not end an existing session
In Plesk, setting SSH access back to Forbidden prevents new sessions, but existing sessions remain open until they close. Ask the collaborator to exit and, when appropriate, ask the provider to terminate active sessions.
Use least privilege for agency collaborators
- Grant only the protocol needed: SFTP for file transfer, SSH only when command execution is necessary.
- Use the narrowest shell that completes the task; start with a chrooted option where available.
- Do not grant root access or share a server administrator credential for routine website work.
- Do not send private keys through email or store them in a ticket, repository, or public web directory.
- Keep a record of who received access, which domain it covers, the authentication method, and the planned expiration date.
- Review scheduled tasks before changing Plesk shell scope.
- Ask the provider for a separate restricted-SFTP feature when access must be limited to a particular directory.
Remove access when the assignment ends
Plesk
- Open Websites & Domains > Hosting & DNS > Hosting for the domain.
- Set SSH access to Forbidden and save.
- If key authentication was used, remove or revoke the collaborator’s public key from the domain’s SSH Keys page.
- Confirm that any active session has been closed and review scheduled tasks if the shell setting changed.
cPanel or provider-managed hosting
Use the provider’s documented control for disabling shell access, removing the SSH-capable account, or revoking its authorized key. If no control is exposed, open a support request and state exactly which username and domain should lose access. Do not delete an account blindly if it owns production files or scheduled jobs; have the provider confirm the dependency first.
Final handoff checklist
- Panel and provider identified.
- Correct SSH-capable identity confirmed.
- SSH or SFTP availability verified with the host.
- Hostname, port, username, and authentication method delivered securely.
- Shell scope selected for the actual task.
- Scheduled-task paths reviewed before any chroot change.
- Connection tested with a non-destructive operation.
- Public key and private key handling agreed.
- Expiration or removal date recorded.
- Access revoked and sessions closed after the work.
The safest agency-hosting setup is the one that matches the panel’s real account model: a Plesk domain system user with a restricted shell when Plesk is in use, or a provider-approved SSH account in cPanel. Treat SFTP as an SSH service, verify every connection field with the host, and never substitute an FTP login for an SSH identity.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
