Confirm the plan permits SSH and identify the person’s purpose, duration and credentials. On managed hosting, ask the provider to make server-level changes that fall outside your reseller privileges.

1. Open Manage Shell Access and locate the exact account row. Avoid the controls that change every account.
2. Choose the supported restricted or jailed shell where appropriate instead of unrestricted shell by default. Coordinate with the server’s CloudLinux and filesystem isolation configuration.
3. Save the change and have the authorised user test a new SSH connection with their approved key. Verify only the required commands and paths are available.
4. Record a removal date for temporary work. Revoke the user’s keys and other separate access when the task finishes.
5. When disabling shell, test new shell and SFTP connections separately because a disabled interactive shell can still permit SFTP under some server configurations.

The account should have only the intended access and the website should remain functional. Check whether the account’s package relationship changed after the shell override.

A jailed shell is not a guarantee against every unsafe command or application action. If access must be fully removed, involve the administrator in reviewing shell, SFTP and keys together. Existing sessions may require separate handling during an incident.

No. FTP service access and the hosting account’s shell are separate permissions. Use the appropriate access method and avoid sharing the owner identity to work around a restriction.

• Adding an SSH public key to a cPanel account
• Revoking an old SSH key after a developer leaves
• Using cPanel Terminal for a read-only first diagnosis
• Applying reseller contact details and branding without changing server ownership

• cPanel: Manage Shell Access
• cPanel: SSH Access