CloudPanel security: users, SSH, and access control

CloudPanel gives you root-equivalent control over every website on your VPS. A compromised CloudPanel admin account means full access to all sites, databases, and files. These steps cover the most important protections.

Strong admin password

Change the admin password immediately after your first login if it was auto-generated:

1. Log in to CloudPanel
2. Click your username in the top right → Account Settings
3. Update the password to something strong and unique-at least 16 characters

Do not use the same password for CloudPanel, the Linux root account, and database accounts. Each should be separate.

Two-factor authentication

CloudPanel supports TOTP-based two-factor authentication. With 2FA enabled, even if your password is compromised, an attacker cannot log in without your authenticator app. Enable it immediately after setting a strong password. See How to enable 2FA in CloudPanel.

SSH hardening

The Linux server itself needs to be secured, not just the CloudPanel panel. Key SSH hardening steps:

• Disable root SSH login with passwords: Edit /etc/ssh/sshd_config and set PermitRootLogin prohibit-password (allows key login, not password)
• Use SSH key authentication: Add your public key to /root/.ssh/authorized_keys and disable password authentication entirely (PasswordAuthentication no)
• Change the SSH port from 22 to a non-standard port to reduce automated scan attempts. Update the CloudPanel firewall to allow the new port
• Install Fail2Ban to automatically block IPs with repeated failed SSH login attempts

For a full SSH guide, see SSH hardening on a Linux VPS.

Restrict panel access

CloudPanel runs on port 8443. By default it is accessible from any IP. To restrict it to your specific IP only:

1. Go to Admin → Firewall in CloudPanel
2. Delete or modify the rule for port 8443 to allow only your IP address
3. Or use the command line: ufw allow from YOUR.IP.ADDRESS to any port 8443 and ufw delete allow 8443/tcp

Manage users and permissions

• CloudPanel supports multiple admin users-create individual accounts for team members rather than sharing the main admin password
• Each site's system user is isolated to its own directory. Do not grant system users sudo privileges
• Remove SSH access for site system users that do not need it-SFTP-only access is sufficient for most file management tasks
• Regularly review which users have access and remove any that are no longer needed

Security checklist

• ☐ Strong, unique CloudPanel admin password
• ☐ Two-factor authentication enabled
• ☐ Root SSH password login disabled-key-based auth only
• ☐ SSH port changed from 22 (optional but reduces automated scans)
• ☐ Fail2Ban installed and configured for SSH
• ☐ Port 8443 restricted to known IPs if possible
• ☐ SSL certificate issued for all sites
• ☐ WordPress plugins, themes, and core updated
• ☐ File permissions set correctly (755 dirs, 644 files, 640 for wp-config.php)
• ☐ Backups created and stored off-server
• ☐ OS packages up to date: apt update && apt upgrade

Related: How to enable two-factor authentication in CloudPanel | How to configure the CloudPanel firewall | How to connect to your VPS via SSH | How to secure your website

Related articles