Accounts: resellers and users

What this page is for. Sell hosting on your server, or give each customer their own sign-in, with limits — the way WHM and cPanel do it. You make packages (how much an account may have), resellers (who sell to their own customers) and users (one customer and their websites).

You need

• The panel open, on the Accounts page (in the menu, after AI Coding).
• SixPanel Pro+ to make new accounts. Pro+ is everything in SixPanel Pro, plus accounts. Its price is shown on allsweb.com.

The server stays yours. An account's menu is Projects, Email and Accounts. It never sees the server's pages (Home, DNS, Server, Backups, Activity, Security, AI, AI Coding, Migration, Addons, Settings), your own websites, your 6amMart shops, or another account's anything — the panel refuses them, whatever address is typed. Its Email page holds only the mail of its own websites.

Packages

A package says how much an account may have:

Mail is not counted in the disk space — the disk space counts websites. So for an account whose package has disk space, each mailbox is at most that much, and never "no limit".

Leave a field empty for unlimited. Change a package and every account on it takes the new numbers — press nothing else. An app that is running moves into its new limits with one restart.

A package holds whoever makes the thing. A website, a database, a mailbox (and its size) or an FTP user made on an account's website counts against its package whether the account makes it, you make it on its website, or Tia or a token does: past the package, each is refused with the sentence that says which limit. Your own websites have no package.

A reseller's package counts the reseller and all its users together. If it says 20 websites, the reseller and its users have 20 between them, whatever the users' own packages say — so a reseller may hand out packages that add up to more than its own (overselling), and the real total is what is held.

A reseller makes packages for its users too. Each number can be at most its own; a field it leaves empty takes its own number.

Make a package

1. Open Accounts → Packages → New package.
2. Give it a name, choose whether it is for users or resellers, and fill in the limits.
3. Press Save.

A package that an account uses cannot be deleted: give those accounts another package first.

Accounts

Make an account

1. Open Accounts → New account (a reseller sees New user).
2. Choose User or Reseller, a username (3-32 lowercase letters, digits, dot, dash or underscore), and a package. For a user, you can choose the reseller it belongs to.
3. Type a password, or leave it empty: the panel makes a strong one.
4. Press Make the account.

Save this now. A password the panel made is shown once, with a Copy button. The panel keeps only a hash of it. If it is lost, open the account and press Set password.

The account signs in on the same sign-in page you use, with its username and password. It can turn on two-factor sign-in for itself on its own Accounts page.

What an account can do

• Make websites — static, Node.js, PHP, WordPress, Python and Java — inside its package; its create dialog offers it those kinds and no other. A Create with AI website stays yours: it uses your Pro.
• Everything on its websites' own pages: deploys, its domains and HTTPS, environment, logs, scheduled tasks, files, Redis when its package includes it, backups (putting its website back), WordPress, web rules, and the PHP or Node.js version among those installed.
• Databases (a website's Database page): more than one, in any engine the server has installed, with their users, import and export. A new one counts against its package.
• FTP users (a website's SSH/FTP page): see them and how to connect, add one (it counts against its package), set a user's password, change its folder, switch it off and back on, remove it. Adding one, a new password and switching one back on each open a way into the server, so the account confirms it is them first — see Confirming it is them below.
• Caching (a website's Caching page): what keeps its website fast — Varnish, its Memcached, Redis, the WordPress page cache, compression — and Purge cache. Turning Varnish or Memcached on or off, their sizes, the object cache and Brotli stay yours: each changes what runs on the server. The page shows those switches greyed, and says so.
• Mailboxes and forwarders (the Email page, Mailboxes and Forwarders tabs) on the mail domains of its websites: make and remove mailboxes, and set their passwords, sizes, autoresponders and filters. A new mailbox counts against its package.
• Turn a website's PHP mail() and sendmail off (its PHP page; sendmail on a Node.js, Python or Java website's Settings) — never on: on lets any code on that website send mail as anyone from this server, so it is yours, and the panel asks you first.
• Change its own password and two-factor.

Not for an account: a website's terminal and SSH users, staging sites, the AI agent and AI Coding, Apache, a website's Vhost page, moving a website to another server, and the PHP settings page — an account sees its website's PHP settings and chooses its PHP version among those installed; extensions and the other settings act on the server's PHP and stay yours. Nor are a Docker app or a reverse proxy (Docker runs its containers as root, and a proxy can reach the server's own addresses): you cannot make one for an account or hand one over, as with Create with AI.

What stays yours: a mail domain. You add it on the Email page's Domains tab, for the account's website. Its mailboxes and forwarders are then the account's to make. The mail server's own settings, queue, logs and webmail stay yours, as do the FTP server's own settings.

Domains. An account adds a name only under a domain no other website of the server uses — by its own names or as its mail domain — never under your panel's own domain or your shops', and never a name SixPanel Email answers on: the mail host, and each mail domain's webmail, autoconfig and autodiscover names. Its websites never use the Cloudflare accounts you added to the panel: the panel checks that its names point here and gets HTTPS over HTTP. Its DNS records are made where its domain is managed.

Confirming it is them

What opens a way into the server — today a new FTP user, a new FTP password and switching an FTP user back on — asks the account to confirm it is them, the way the panel asks you: with its own password, or its current two-factor code when it has turned two-factor on. Never with yours: your password is a wrong password there.

The same rules hold as for you. Security → Confirming it is you → Ask again after (Every time, 2, 5 or 15 minutes) is the account's window too, and signing in with its password counts as confirming. A code is taken once. Five wrong codes on one sign-in ask for the password as well. Every wrong answer counts against the address like a wrong sign-in and is on the Activity page. Twenty wrong codes of one account, from any address, stop that account's codes for fifteen minutes — never yours (Let every address in on Security lifts it). A new password or a change to its two-factor ends the confirmation.

Open, change and hand over

Press Open on an account to see, row by row, what its package allows against what it uses, what it is running right now, and its websites. From there:

• Save a new name, email, note or package.
• Hand a website to this account: one of your websites becomes theirs (a reseller hands its own websites to its users). Everything it brings counts against the account's package — its databases, mailboxes and FTP users too. Take back gives it back.
• Measure the disk again and Apply limits now.
• Set password (every session of the account is signed out).
• Delete account: type its username to confirm. Its websites are kept — a reseller's user's go to the reseller, every other account's to you. A reseller that still has users is not deleted.

Suspend

Suspend stops an account without deleting anything:

• it cannot sign in, and a session it had ends;
• every visitor of its websites sees a short "This website is suspended" page, and nothing of them starts — no app, no scheduled task, no deploy. HTTPS keeps renewing;
• its Node.js, Python and Java apps that are running are stopped;
• nobody signs in to its websites over SSH, SFTP or FTP, and the sessions that were open end. Its SSH keys and FTP users are kept, and nothing new can be added or switched on until it is unsuspended.

Unsuspend starts again exactly the apps the suspension stopped (one you had stopped stays stopped), and opens SSH and FTP again as they were. So does handing one of its websites to another account, taking it back, or deleting the account.

Suspending a reseller suspends its users with it, and Unsuspend gives back exactly those. When you suspend a reseller's user, its reseller cannot lift it.

Log in as

Log in as opens the account's own view of the panel in your browser for up to two hours — exactly what they see and can do, to help them or check something. A line at the top says so, with Back to my own account. It is on the Activity page, both ends — however it ends: Back, signing out, its two hours, the account suspended, deleted or given a new password, or the panel restarting (such a session is kept in memory only). A reseller can log in as its own users.

A Log in as session confirms nothing: it does not know the account's password, and your own confirmation belongs to your own sign-in. So a new FTP user, say, is refused there with a sentence that says why: press Back to my own account and do it on that website's page, or the account does it itself.

Limits, and how they are held

Each account with CPU, memory, I/O or process limits gets its own systemd slice, sixpanel-acct-<id>.slice (a reseller's user's sits inside the reseller's). Its Node.js, Python and Java apps, its scheduled tasks and its builds and deploy commands run in it. An app that was already running when the account got its limits is started again inside the slice by Apply limits now, and by every change of its package.

PHP websites are held differently: every PHP website is a pool of the server's one PHP-FPM, so a limited account's PHP websites get its PHP workers (split between them) and its memory, locked so a script cannot raise it, and they give way to your own websites under load. The CPU and disk I/O limits do not reach PHP — the account's page says so beside them.

Your own websites are never in a slice of the panel's and are never changed by any of this.

When Pro+ ends

Nothing stops. Every account keeps signing in and every website keeps serving with its limits. Only making a new account needs Pro+ again; the page says so with the way to upgrade.

Ask Tia

Tia can list the accounts and packages, say what an account uses, make or change a package or an account, suspend, unsuspend and hand websites over — each change waits for your yes. She never sees or sets an account's password and never logs in as one: an account she makes has no password until you set one on its page.