Create an SSH key and save it to your hosting account

The panel offers password authentication for SSH, and it works. An SSH key is still the better tool, because a password can be guessed, reused across sites, and captured by something on the machine you typed it into. A key pair removes that whole category of problem.

Two files come out of the process. One goes to the server, and one never leaves your machine.

Which half goes where

A key pair is two related files. The private key is the secret. The public key is the part you hand out, and it is safe to send because it cannot be used to authenticate without the private half.

Add the public key to the server. Keep the private key on the machine you connect from. If a tutorial ever asks you to paste the private key into a web form, stop.

Making the pair

Open a terminal. On macOS or Linux, ssh-keygen is already there.

ssh-keygen -t ed25519 -C "your-name or a note about this machine"

Use Ed25519 unless you have a reason not to. It is the current default recommendation, it produces a short key, and every SSH client that matters supports it. Older guides suggest RSA with a length of 2048 or more. That still works, it is just the larger and older option.

The command asks where to save the file and then asks for a passphrase. Press enter to accept the default location, which is ~/.ssh/id_ed25519. A passphrase is optional and worth taking. It means a copy of the private key file is not enough without the passphrase.

On Windows, ssh-keygen ships with Windows 10 and later in PowerShell, so the same command applies. PuTTY users generate with PuTTYgen instead and should note that PuTTY needs the key in its own .ppk format.

The result is two files. id_ed25519 is the private key. id_ed25519.pub is the public key, and it is one line of text.

cat ~/.ssh/id_ed25519.pub

Adding your SSH key to the site

Sign in, choose Websites in the left menu, and open Manage websites. Find your domain, open the three dot menu at the right of its row, and choose Manage.

Select Advanced in the top bar, then SSH key manager in the left panel. Choose Add, give the key a name you will recognise later, and paste the whole public key into the key field. The name is for you. Call it after the laptop or the person, because a list of unnamed keys is a list you cannot audit.

The Add button sits at the right of the SSH key manager page. Once a key is listed there, the panel also shows the login command to use.

Connecting

The first connection asks whether to trust the host, and that prompt is not a formality. Check the fingerprint against the one in the panel before you accept, or accept on a network you trust and move on. A fingerprint that changes later is worth investigating rather than clicking through.

Once accepted, the host is recorded in ~/.ssh/known_hosts and the prompt stops appearing.

ssh -p 22 username@server-address

If the key has a passphrase, you will be asked for it. That is the passphrase protecting the key file, not a password for the server. An agent loads the key once per session so you are not retyping it.

eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519

Naming the host in your SSH config

Once the key works, the useful next step is to stop typing the address, the port and the username every time. An SSH config file holds those, so the connection becomes one short name.

The file is ~/.ssh/config. The ~/.ssh folder is created by ssh-keygen, so it usually exists already, and the config file may not. Create it if it is missing.

Host mysite
    HostName 203.0.113.10
    User yourusername
    Port 22
    IdentityFile ~/.ssh/id_ed25519

After that, ssh mysite connects, and so does sftp mysite, and a development tool that asks for an SSH host accepts the same name. It is one place to change the address if the server ever moves.

The indentation is conventional rather than required, and the IdentityFile line is only needed if your key is not at a default path.

On Windows, recent versions ship OpenSSH as an optional feature, so ssh, ssh-keygen and the same config file all work from PowerShell once it is enabled. The path is %USERPROFILE%\.ssh\config rather than the Unix one, and the file still needs creating by hand. PuTTY does not read this file, so PuTTY users keep their settings in the PuTTY profile instead.

Getting files in and out

SFTP uses the same key and the same account. No separate key to add.

sftp -P 22 username@server-address

The -P is a capital letter, which catches people who paste -p from an SSH command. Lowercase p means something else in SFTP and the connection fails with a message that names neither.

scp copies a file in one line and is usually faster than opening an interactive session.

scp -P 22 ./local-file.zip username@server-address:public_html/

Your files live under public_html. That is the directory the web server serves, and it is the one to upload into. A WordPress install is the usual reason to be here, and the hosting plans page covers which sites come with one preinstalled.

What breaks, and how it looks

A key that is refused when you are certain it is correct is usually one of three things. The public key was pasted with a line break in the middle and only the first line arrived. The key was saved to the wrong account, which happens when more than one site shares a panel login. Or the key file is present but the agent is holding a different one, and ssh-add -l will show you which.

A permission error on the key file is the fourth. SSH refuses a private key that is readable by other users on the machine.

chmod 600 ~/.ssh/id_ed25519

When you stop using a machine

Delete the public key from the panel rather than leaving it. A key on a laptop that was sold, wiped, or handed to a colleague is still a way in until somebody removes it from the server, and the panel list is the only place that shows what is currently authorised.