Secure your Virtualizor account with 2FA and SSH keys

Anyone who gets into your Virtualizor account can reinstall your VPS, read its console or power it off. Protecting the panel login is as important as securing SSH on the server itself. This guide covers the account security features in the Virtualizor end-user panel.

Before you start

• Access to the Virtualizor panel; see panel overview.
• An authenticator app on your phone (Google Authenticator, Microsoft Authenticator, Authy or a password manager with TOTP).

Change the panel password

1. Log in and open your account menu (your email or user icon at the top).
2. Choose Change Password (or Account → Password).
3. Enter the current password and a new random password of at least 14 characters.
4. Save.

This is the panel password. It is separate from your VPS root password; change that under the VPS settings, see root password and hostname.

Enable two-factor authentication

1. Open the account menu and choose Security (or Two Factor Authentication).
2. Select App based (Google Authenticator). Email-based codes may also be offered, but an app is safer.
3. Scan the QR code with your authenticator app.
4. Enter the 6-digit code to confirm and save.
5. Store the backup or emergency codes in a password manager.

If your provider also offers single sign-on from their client area, secure that account with 2FA too, because it can open Virtualizor without a password.

Restrict login by IP

Some Virtualizor versions let you list IP addresses allowed to log in under the same Security page. If you always manage servers from a fixed office or VPN IP, add it there. Keep the list current, or you may lock yourself out when your IP changes. Find your current IP with the IP checker.

Add SSH keys for installs

1. Generate a key on your computer: ssh-keygen -t ed25519.
2. In Virtualizor, open SSH Keys (account menu or VPS settings) and click Add Key.
3. Paste the content of the .pub file and give it a name.
4. When you reinstall the OS, select the key so the new system accepts it for root login immediately.

After the install, consider disabling SSH password login entirely in /etc/ssh/sshd_config with PasswordAuthentication no.

Review logs

• Logs or Login Logs show recent panel logins with IP addresses.
• Tasks lists actions such as reinstall, restart and password changes.

An unknown login or action you did not start means someone has your password: change it, enable 2FA and contact your provider.

Troubleshooting

• 2FA codes rejected: set the phone's time to automatic.
• Lost the phone: use a backup code, or ask your provider to disable 2FA after verifying your identity.
• Key not accepted after reinstall: the template may not support key injection; add the key manually to ~/.ssh/authorized_keys.

Next steps

• Configure firewall rules.
• Reinstall with an SSH key.
• Connect over SSH.