You've got a shared cPanel hosting account and you need to run wp-cli, pull a git repo, or just poke around with ls instead of clicking through File Manager one folder at a time. Good news: most cPanel accounts already have SSH access — you just have to turn it on and set up a key, which takes about five minutes if you know where to click.
Symptom: "Permission Denied" or No SSH Option At All
There are two versions of this problem. In the first, you try to connect with something like ssh yourusername@yourdomain.com and get Permission denied (publickey) or the connection just times out. In the second, you log into cPanel looking for an SSH option and don't see one anywhere near Security or File Manager.
Neither means SSH is broken. It usually means one of two things: the feature is disabled at the account level by your host, or it's enabled but you haven't generated and authorized a key yet — cPanel's SSH Access manager doesn't accept password logins by default, so a login attempt without a key will always fail.
Cause: cPanel SSH Access Is Off By Default (and Key-Only)
A few things are different about SSH on shared cPanel hosting compared to a VPS you control:
- You're not root — you land in your home directory (
/home/yourusername) with the same file permissions you already have in File Manager, nothing more. - The feature is called SSH Access in cPanel, under the Security section, and it can be switched off entirely by the hosting plan or by WHM at the reseller/server level.
- Password authentication for SSH is disabled on almost every shared server for security reasons. Public key auth is the only supported login method, which is exactly why a fresh account with no key on file gets rejected every time.
So the actual fix isn't "reset a password" — it's "generate a key pair and authorize the public half in cPanel."
Fix: Enable SSH Access and Generate a Key in cPanel
Step 1 — Confirm SSH Access Is Enabled on Your Account
Log into cPanel and search for SSH Access in the top search bar, or find it under the Security section. If the icon isn't there at all, your hosting plan doesn't include shell access — on SkyServer accounts this is usually a quick support ticket to enable, since it's a per-account setting rather than something you can toggle yourself.
Step 2 — Generate a New Key Pair (Inside cPanel)
You don't need a local terminal for this part — cPanel can generate the key pair for you:
- Open SSH Access → Manage SSH Keys.
- Click Generate a New Key.
- Leave the key type on the default (RSA 2048/4096, or ED25519 if your host offers it) and set a passphrase — you can leave it blank for automation use, but a passphrase is safer for anything you'll type by hand.
- Click Generate Key.
Step 3 — Authorize the Public Key
Generating a key isn't enough on its own — cPanel creates the pair but doesn't automatically trust it. Go back to Manage SSH Keys, find your new key under "Public Keys," and click Manage next to it, then Authorize. Only after this step does the key actually get added to ~/.ssh/authorized_keys on the account.
Step 4 — Download the Private Key
From the same Manage SSH Keys screen, download the private key to your own machine — cPanel won't show it to you again after you navigate away, and it never stores a downloadable copy for security reasons. Keep it somewhere outside your project folder, and never commit it to a git repo.
Step 5 — Connect
On macOS or Linux, point the SSH client at the downloaded private key:
ssh -i ~/Downloads/yourusername.key yourusername@yourdomain.com -p 22Check the exact port first — many shared servers move SSH off port 22 to something like 2222, which cPanel shows right on the SSH Access page under "Connect Using SSH." Using the wrong port is the single most common reason a correctly authorized key still fails to connect.
On Windows, convert the downloaded key to .ppk format with PuTTYgen (Load → select the key → Save private key), then load it in PuTTY under Connection → SSH → Auth → Credentials before connecting.
No Local Terminal? Use cPanel's Built-In Terminal
If you just need to run a couple of commands and don't want to deal with key files at all, cPanel has a browser-based Terminal app (search for it the same way you found SSH Access). It uses your existing cPanel login session, so there's no separate key setup — handy for a quick wp-cli command or checking disk usage, though it's not a substitute for a proper SSH client if you're doing real development work.
Quick Reference: SSH Access vs SFTP vs cPanel Terminal
| Method | Needs a Key? | Good For |
|---|---|---|
| SSH Access (Manage SSH Keys) | Yes, mandatory | wp-cli, git, cron scripting, real shell work |
| cPanel Terminal (browser) | No | One-off commands, quick checks, no local setup |
| SFTP | Optional (password works too) | File transfers only, no command execution |
Prevention: Keep SSH Access Tidy
- Remove keys you don't recognize. If you ever see a public key in Manage SSH Keys you didn't add, un-authorize it immediately and change your cPanel password.
- One key per device. Don't share the same private key file between your laptop, a CI pipeline, and a contractor — generate a separate key pair for each so you can revoke one without breaking the others.
- Turn SSH Access off if you're not using it. If shell access was enabled for a one-time migration or a plugin install and you're done, disabling it under Security → SSH Access shrinks your account's attack surface with zero downside.
- Keep the private key file offline-safe. Anyone with that file and no passphrase can log in as you — treat it the same way you'd treat a password.
Frequently Asked Questions
Why can't I just use a password to log in over SSH?
Shared cPanel servers disable SSH password authentication host-wide because it's the single biggest source of automated brute-force attempts. Key-based login is enforced for every account, not just yours, so there's no setting on your end to switch it back to password auth.
I authorized a key but I'm still getting "Permission denied (publickey)". What's wrong?
Check three things in order: the port (many shared servers use a non-standard port shown on the SSH Access page, not 22), the username (it's your cPanel username, not your domain), and that you're pointing the client at the private key file, not the public .pub file.
Can I upload my own public key instead of generating one in cPanel?
Yes — on the Manage SSH Keys page there's an "Import Key" option alongside "Generate a New Key." Paste in a public key you already created with ssh-keygen locally, then authorize it the same way.
Does enabling SSH Access give me root or server-level access?
No. You log in as your own cPanel user, confined to your home directory with the same file ownership and permissions you already have through File Manager and FTP. It's shell access to your account, not the server.
My host says SSH Access isn't available on my plan — what are my options?
Some entry-level shared plans disable shell access entirely for security and resource reasons. If you need it regularly for deployments or wp-cli, ask your host to enable it on the account (SkyServer can turn this on for eligible plans via a support ticket), or consider moving that workload to a VPS where you control SSH directly.
