First login and the setup wizard

What this page is for. Open the secret panel address for the first time, set up two-factor login, and walk through the guided setup.

You need

• The panel URL, the username and the password the installer printed. If you lost any of them, see Install SixPanel — all three can be recovered from the server.
• A free authenticator app on your phone (Google Authenticator, Aegis, Authy, 1Password, or the one built into your password manager).
• The three ports open at your hosting provider (The three ports).

1. Open the whole address

Paste the entire URL into your browser, including the code at the end:

https://203.0.113.10:41397/8ec0896a1f2b...

The last part is the secret entry code. Without it the address returns a blank "not found" page. That is not a fault — it is what hides your login page from people scanning the internet.

Bookmark the address now.

The panel is always https. There is no http version.

2. Click through the certificate warning — once

Your browser shows a warning like "Your connection is not private". This is expected. Until you give the panel its own domain and certificate, it uses a certificate it made for itself, and browsers do not trust those.

Choose your browser's "Advanced" option and then continue to the site. Your connection is still encrypted.

The warning also appears when you reach the panel by IP address after getting a certificate, because the certificate is issued for a name, not a number. That too is normal.

3. Log in

The login page asks for two things: a username and a password.

The username was made for you when SixPanel was installed. It is not simply admin — it is admin with a few random characters after it, so that a robot which finds your login page has nothing to aim at. Both the username and the password were printed by the installer.

Lost the username? On the server:

sudo sixpanel username

You can change it later on the Security page.

4. Set up two-factor login

The first time you log in correctly, the panel does not open yet. It shows Set up two-factor login and waits there.

Do it. This panel controls your whole server, so a password on its own is not enough.

1. Open your authenticator app and scan the QR code on screen. Cannot scan? Choose "enter a setup key" in the app and type the key shown under the code.
2. The app starts showing a 6-digit code that changes every 30 seconds.
3. Type the current code and press Turn on two-factor login.

No phone to hand right now? That screen also offers Not now — continue without two-factor login, and it is a real way through. It asks you to confirm once, then the panel opens on your password alone from then on. It is written to your activity log, the Security page shows two-factor as off, and you can turn it on there in about a minute. Skip it only if you have to, and come back to it the same day.

Set it up on a phone you keep, not a phone you are about to replace. If you lose it, the way back is one command over SSH on the server: sudo sixpanel 2fa off. That forgets the old phone, and your next login shows a fresh QR code to scan with the new one.

From now on, every login asks for the username, the password and the 6-digit code.

Expected result: the panel opens, and the setup wizard appears.

5. Walk through the setup wizard

On a new server the wizard opens by itself. It has three steps and a finish screen, and it is about the panel itself — not about your project. Your first project comes right after it, with its own guided flow.

Every step can be skipped (Skip this step), and the whole wizard can be left with Skip setup — straight to the panel. Nothing is lost either way; the same work is available on the normal pages afterwards.

Welcome

Three fields: Language, Timezone and Your email address. All three arrive pre-filled — the language from your browser, the timezone from your browser's clock — so usually you only check them and press Save and continue.

The email address matters more than it looks. Free certificates are issued against it, and server alerts are sent to it.

The timezone is the clock your backups, scheduled tasks and logs follow. Pick it now rather than later.

Expected result: the step is marked done and the wizard moves on.

Password

Type the password you logged in with under Current password, then your own under New password, and repeat it.

Press Suggest a strong password and the panel generates one and shows it once, so you can copy it into your password manager. Then press Change password.

Changing the password signs out every other browser. Your username and your 6-digit code are not affected.

Expected result: the step is marked done.

Panel address

This step moves the panel off https://IP:PORT/CODE and onto a name of your own, like panel.example.com, with a real certificate.

1. Type the Panel domain — just the name, no https:// and no slash.
2. Press Check. The panel looks the name up and tells you which of three situations you are in:

• it is on Cloudflare and your connected account manages it — one click does everything;
• it is on Cloudflare under a different account — enter that account's Account ID and API token, and it becomes the first case;
• it is not on Cloudflare — the panel shows the exact A record to create at your DNS provider, and a check again button.

1. Press Make the panel live on this address. The panel creates the DNS record (when it manages your Cloudflare account), waits for the name to point here, gets the certificate and rewrites the web server — all as one job with a live progress list you watch.

Expected result: Your panel has a new address, with a button to open it. Bookmark the new address.

This is the most common way people lock themselves out. Once the panel domain has a certificate, the panel answers only on that name — the address with the IP and the port stops working, on purpose, so nobody can find it by scanning ports. Your way back is always SSH: sudo sixpanel domain none, then sudo sixpanel info.

Not ready? Press Set the panel address later. The panel keeps its IP address and port, and you can do this any time from the Security page.

Finished

The last screen says Panel setup complete and reminds you what now runs by itself: certificates renew, a failed service is restarted and you are told about it, and daily backups are one click away on the Backups page.

It ends with Create your first project. That is the next thing to do, and it has its own guided flow — see Domains and HTTPS and Install your 6ammart code.

6. Create your first project

Pressing Create your first project opens the project wizard on the Projects page. You type one domain and the panel plans the rest from it:

• the admin panel address,
• the website address (and optionally www.),
• the live updates (websocket) address.

If Cloudflare manages that domain, the panel then runs one chain in front of you: create the project's own database, services and folders → register the addresses → create the DNS records (always proxied, so your server's address stays hidden) → certificate for the admin panel → certificate for the website.

If the domain is not on Cloudflare, the project is still created; the panel shows you the exact records to add at your DNS provider, and you come back for the certificates afterwards.

Then press Continue to install the app — Install your 6ammart code.

How to check it worked

• The Home page opens and shows your server's processor, memory and disk.
• Open Server → Health. It runs more than thirty checks. Green is good, and every problem carries a one-line fix.
• Signing out and back in asks for the username, the password and a 6-digit code.

If it went wrong

"I cannot reach the panel at all"

In order:

1. The ports. The panel port, 80 and 443 must be allowed at your hosting provider. This is the most common cause by a wide margin. See The three ports.
2. The whole address. A blank "not found" page means the secret code at the end is missing or wrong.
3. On the server, run sudo sixpanel doctor --self. It runs every check that does not need the panel, and prints a fix under each failure.

"I gave the panel my own domain and now nothing opens"

This is the most common lock-out, and it is by design. Once your panel domain has a certificate, the panel answers only on that domain. Reaching it by IP address and port stops working, so nobody can find it by scanning ports.

If the domain has a typo, or its DNS breaks, you appear to be locked out. You are not. Log in to the server over SSH and run:

sudo sixpanel domain none

That clears the panel's custom domain and brings the IP address back. Then run sudo sixpanel info for the address to open. This works even when nginx is broken.

"I lost the panel URL"

sudo sixpanel info

"I lost the username"

sudo sixpanel username

"I lost the password"

sudo sixpanel password reset

It tells you what it will change, asks you to confirm, then prints a new password. The old one cannot be recovered — only a hash of it is stored.

"I lost the phone with the 6-digit codes"

sudo sixpanel 2fa off

This forgets the phone you set up; it does not switch the feature off for good. Log in with your username and password as usual, and the panel offers you a fresh QR code to scan with the new phone. If you have no phone at that moment, that screen also offers Not now — continue without two-factor login, so losing a phone can never lock you out of your own panel.

"The site shows a 500 error"

If you have not finished installing your 6ammart code yet, this is normal — see Install your 6ammart code. Otherwise read When something is broken.

"The setup wizard keeps coming back"

The wizard shows while any of its steps is still open. Finish them, or press Skip setup — straight to the panel and confirm; it does not appear again.