Panel users and roles

The entry appears for accounts that may manage users, which is owners and administrators. Everybody else does not see it, rather than seeing it and being refused.

Two roles run the server. Owner and administrator hold the same permissions in the panel: every website, customers, other users, grants, and the server pages. The difference is that there is one owner and it is the account the installer created.

Customer is the role for somebody who has their own websites. They can create websites and run them completely, and they see nothing of the server itself and nobody else’s sites.

Developer is for somebody working on a site they do not own. They can edit files, manage DNS, manage scheduled tasks and mailboxes, create databases and create backups. They cannot restore a backup, delete a database, replace a certificate, or change the website’s own settings.

Read only sees and changes nothing. It is the right answer for an auditor, for somebody being shown a problem, and for anybody whose job that week is to look.

There is a sixth role you never assign. A website can have an account of its own, and that account is locked to that one website: no grant widens it and no customer membership adds a second site to its view.

A customer runs their websites completely and still cannot delete one. That is deliberate: deleting a website is the only action here that destroys something no other screen can bring back, so it is not something a role hands out quietly along with twenty useful things. An administrator grants it on one website at a time, to one account, and it applies to that website only.

Everything else that looks irreversible has a way back. A deleted database was in last night’s recovery point. A deleted backup leaves the others. A deleted website leaves nothing.

You can give any account an explicit list of permissions on a single website. When you do, that list is what applies there, in place of whatever the role would have said. So a read only account can be given files.write on one website without becoming a developer everywhere, and a developer can be given backups.restore on the one site they are actually responsible for.

This is the mechanism to reach for when a role is nearly right. Changing somebody’s role to fix one website changes it for all of them.

Suspend a website, or suspend the customer who holds it, and every permission on it becomes none, for everybody except an owner or administrator. Not a smaller set: none. The website disappears from the customer’s view rather than sitting there refusing them one action at a time, which is the honest rendering of what suspension means.

customer, site running      sites.view sites.edit files.write ...
customer, site suspended    (nothing)
customer suspended          (nothing)
administrator, suspended    everything

The last line is why an administrator can still fix a suspended site, and why suspension is not a way to hide something from the person running the server.

Give the smallest role that works and add a grant where it falls short, rather than giving administrator because it is quicker. An administrator account is a second set of keys to the whole machine, including the server pages and the services.

Turn on two-factor sign-in for every account that can change anything, and require it for administrators so a new one cannot be added without it. That is on Two-factor sign-in and panel security.

When somebody leaves, disable the account rather than deleting it. The record of what they did stays readable under Operations, and a deleted account leaves actions attributed to nobody.

Who may reach the panel at all, by address, is a separate question and lives in The server firewall under Panel access. Customers and hosting packages are Customers and packages.