Quick answer
Remove authorization for the specific public key when a device, contractor, or coding workflow should no longer connect. Revoking a key is more reliable than asking someone to delete their copy. Review other credentials separately because the same person may also have CMS, SFTP, API, or billing access.
Before you start
Identify the correct hosting account and the public fingerprint for the key being removed. Preserve your own tested recovery access. If the key is shared between people or devices, plan a replacement for authorized users before revocation.
What to do
- Open cPanel SSH Access, Manage SSH Keys, and find the public key by its recorded name and fingerprint.
- Deauthorize that exact key. Remove it after confirming that no approved workflow still depends on it.
- Review related SSH aliases, automation jobs, deployment systems, CMS users, and API tokens. Revoke only the access that should end.
- For suspected exposure, replace affected credentials and inspect recent website/account changes. Preserve logs and backups needed for investigation.
Check the result
Test that the removed key can no longer authenticate and that a separate authorized recovery identity still works. Record the access change and affected automation.
If something does not work
If an unknown key or unexpected login is present, contact support with the account, timestamp, and public fingerprint. Never send the private key as evidence.
Related help
- Create a local SSH alias for a website coding assistant
- Review who has access to your website and connected services
- Review mailbox forwarders and filters after a suspected compromise
Official references
Reviewed October 31, 2026. Interfaces, vendor availability, and account features can change. Check your current account before making changes.
