Occasionally, customers ask why Elmnet does not provide direct cPanel, FTP, or SFTP access to our hosting environment. It’s a fair question, after all, traditional web hosting companies have often handed over full hosting access as standard.
Our approach is different, and it’s intentional.
At Elmnet, we operate a fully managed hosting platform designed specifically around performance, stability, and above all, security. Restricting direct server access is one of the most important ways we protect not only your website, but every website hosted on our infrastructure.
A Managed Hosting Environment
Unlike traditional shared hosting, where customers are expected to manage their own hosting accounts, software versions, security settings, email accounts, and backups, our platform is centrally managed by us.
That means we:
- Universally block all access to cPanel, except through our own office VPN
- Maintain and secure the server environment
- Install security updates and operating system patches
- Monitor server activity and firewall protection
- Manage backups and recovery systems
- Update WordPress core, themes, and plugins
- Monitor for malware and suspicious activity
- Configure and maintain website security tools
This allows us to maintain a consistent security standard across the entire platform.
Why FTP Access Is No Longer Considered Best Practice
Historically, websites were often updated by directly connecting to a server using FTP software. While this was once common practice, modern security standards have moved away from this approach.
Direct file access introduces a number of risks:
- Credentials being stored insecurely on devices
- Passwords being shared between multiple developers or agencies
- Malware on a computer capturing saved login details
- Files being accidentally overwritten or deleted
- Untracked changes being made directly to live websites
- Security vulnerabilities being introduced without review
Even when secure protocols such as SFTP are used, the issue is not just encryption, it’s access control and operational risk. Once third-party access exists, it becomes much harder to guarantee the integrity and security of the hosting environment.
Protecting All Hosted Websites
This is particularly important in a shared managed hosting environment, where security is not just about protecting one individual website.
Our infrastructure hosts multiple customer websites, and maintaining strict access controls helps reduce the risk of:
- Cross-site contamination
- Malware infections
- Compromised developer credentials
- Unauthorised software uploads
- Server abuse
- Accidental configuration changes
Restricting server-level access is one of the reasons we are able to maintain a highly secure hosting environment.
Why Restricting Access Matters
Recently, a critical security vulnerability affecting cPanel servers highlighted exactly why modern hosting environments should avoid exposing hosting control panels publicly wherever possible.
Vulnerabilities of this nature can potentially allow attackers to gain access to hosting systems remotely, even when strong passwords and other protections are in place.
Because of the way Elmnet’s hosting platform is designed, our cPanel and server management interfaces are not publicly accessible from the internet. Access is restricted at firewall level to our office VPN IP address only, significantly reducing the attack surface and preventing unauthorised external access attempts.
This is a practical example of why we operate a managed hosting model with strict access controls. Security is not just about reacting to threats when they happen, but about reducing exposure in the first place.
Modern Development Workflows
Professional modern web development rarely requires direct access to a live hosting environment.
Instead, best practice development typically involves:
- Local development environments
- Staging websites for testing
- Version control systems such as Git
- Controlled deployment processes
- Rollback and recovery procedures
In most cases, websites are developed and tested on a separate development or staging server first, ensuring that everything functions correctly before going live.
Once approved, the completed website can then be migrated into the live WordPress installation using standard WordPress migration tools and plugins, without requiring direct cPanel or FTP access to the hosting platform.
These approaches are significantly safer, more reliable, and better suited to modern website development than making changes directly on a live production server via cPanel or FTP access. For this reason, Elmnet strongly encourages structured development workflows and discourages live-site development wherever possible.
WordPress Access Is Still Provided
Customers still retain full access to their WordPress dashboard, allowing them to:
- Edit website content
- Add blog posts and pages
- Manage media uploads
- Create and manage users
- Carry out day-to-day website administration
What we restrict is direct access to the underlying hosting infrastructure.
Security Is a Shared Responsibility
Cybersecurity threats aimed at websites continue to grow every year, particularly within the WordPress ecosystem. Restricting hosting access is not about limiting flexibility, it’s about reducing unnecessary risk.
Our policies are designed to follow modern managed hosting and security best practices, helping to protect our customers, their websites, and the wider hosting environment as a whole.
While this approach may differ from traditional hosting providers, we believe it provides a safer, more stable, and more professionally managed platform for our customers.