Account security · FiniteHost Help

Your FiniteHost account controls your websites, mail, databases and invoices, so it is worth five minutes to understand how it is protected. This guide explains what FiniteHost does for you and the few things only you can do.

Before you start#

You can sign in to the panel at panel.finitehost.com. If not, see Create your account.

The panel has no account password. Each time you sign in, FiniteHost emails you a fresh code.

Enter your email address on the sign-in page and click Email me a code.
Open the email and find the 6-digit code.
Type the code and click Sign in.

The rules behind it:

Rule	Value
Code length	6 digits
A code expires after	10 minutes
Wrong tries allowed per code	5, then request a new code
Codes per email address	5 an hour
Requesting a new code	Cancels every earlier unused code
Sign-in requests per network address	A few a minute; more get "429 Too Many Requests"
You stay signed in for	14 days on that browser, unless you sign out

FiniteHost does not offer a separate authenticator-app second factor today. The email code is the sign-in check.

Sign out#

Click your avatar (your initial) at the top right of the panel.
Click Sign out.

Always sign out on a shared or public computer. Signing out ends the session in that browser only. There is no "sign out of all devices" button yet: if you lose a laptop or phone that was signed in to the panel, email support@finitehost.com from your account's address and we will help secure the account.

Passwords for SFTP, mailboxes and databases#

You never choose these passwords. FiniteHost generates a long random password each time (20 characters for SFTP and databases, 16 for mailboxes) and shows it once.

FiniteHost stores only a one-way hash, so nobody, including support, can look up a password later.
Lost one? Make a new one: New SFTP password on Files (SFTP), New password on Databases or on Email accounts. The old one stops working.
Keep them in a password manager, not in an email or a note on your desktop.
For SFTP, an SSH key is even safer than a password: see Sign in with an SSH key.

Good habits#

Use an email address you will keep. Invoices, renewal reminders and sign-in codes go there. To change the account's email address, write to support from the current address.
Change passwords when people leave. If a developer or agency had your SFTP, database or mailbox password, make new ones when the work ends.
Do not share the panel by forwarding sign-in codes. A code gives full control of the account for 14 days.
Check the subscription ID before you act. If you have several plans, the plan picker at the top shows which one you are working on.
Be wary of look-alike emails. FiniteHost sign-in codes come from finitehost.com and never ask you to reply with the code or to pay through a link other than the panel.

Troubleshooting#

The code email has not arrived: wait a minute, check spam and promotions folders, then click Send a new code.
"That code is wrong or has expired": codes last 10 minutes and allow 5 tries. Request a new one, and use only the newest email.
"Too many codes requested. Wait an hour and try again": you asked for 5 codes in the last hour. Wait, then try once.
"Your session ended. Sign in again.": the 14 days ran out or you signed out elsewhere in that browser.

What's next#

Website security: how your sites are protected, and keeping WordPress safe.
Backups and restore.
Sign in with an SSH key.