Offboarding a cPanel team user requires reviewing their panel identity and any separate credentials they received. Suspending a team login is a useful immediate measure, while permanent removal should follow a handover and data-retention check.
IN THIS ARTICLE
Prepare for the change
List the person’s authorised tools, service accounts, API tokens, SSH keys and application logins. Preserve relevant audit information and ensure another authorised person can maintain the website or mailbox after access ends.
Check database dependencies as part of the handover or immediately after emergency containment. cPanel creates an associated virtual MySQL user for a team identity, and its status follows suspension, reinstatement or deletion of that identity. If a business application uses that credential, arrange an approved dedicated database user and test the connection so retiring the person does not leave the application dependent on their account.
01 Revoke a departing team member’s cPanel access
- Open Manage Team, locate the exact user and inspect assigned roles, services, last login and any available audit log.
- Use Suspend when immediate panel access should stop while you complete the handover. Note that suspended users with roles can still count toward the role-user allowance.
- Review associated FTP, Web Disk and email service access explicitly. Also revoke separate SSH keys, API tokens or application accounts that are not governed by this team record.
- After preserving required information, choose Delete for a permanent removal and read its confirmation. Do not delete the entire hosting account.
- Test with a fresh login attempt where appropriate and verify remaining administrators and business services still function.
Confirm the expected result
The retired identity should no longer provide the access you intended to remove. Keep a written record of each independent credential revoked so one forgotten integration does not undermine the change.
If the change does not work
If you suspended the wrong user, review the record and use the available Unsuspend action. A deleted user cannot be restored simply by reversing suspension, so recreate only necessary permissions if removal was mistaken. Escalate suspicious activity with timestamps and evidence.
Does changing the owner password finish offboarding?
No. Tokens, public keys and application sessions can have separate lifetimes. Inventory the actual access methods used, revoke each relevant credential and verify the result without disrupting unrelated users.