Web terminal

Administrators can open a server shell in the browser, without an SSH client.

Server › Terminal: the server's root shell.
In a site's details, Terminal tab: a shell as the site's Linux user, in its folder, with the site's PHP version, composer and wp-cli already in the PATH. It is not a root shell: it sees and changes only what the site user can see and change.

Opening a session

Click Open terminal and enter your password again. Copy and paste: select the text and use Copy/Paste or Ctrl+Shift+C and Ctrl+Shift+V (Ctrl+C still interrupts the command). The window follows the size of the page.

Security

administrators only, never while impersonating another user or with an API key;
password required every time; after 5 wrong attempts in 15 minutes you have to wait;
not available when the panel is opened without HTTPS, nor in the public demo;
the session closes after 15 minutes of inactivity (configurable) and in any case after 8 hours; at most 5 sessions at the same time;
every opening and closing goes into the activity log with user, IP address, duration and reason for closing;
if you turn on recording, session output is saved in /var/log/panel/terminal, readable only by root, and deleted after 30 days.

Open sessions are listed under the terminal and can be closed from there.

Settings

In Server › Security, Web terminal box:

Terminal enabled: turn it off to disable it completely;
Who can open the root shell: only the main administrator (the first one created, default), all administrators, or nobody. Only the main administrator can change this choice;
Record session output;
Close after minutes of inactivity (1 to 240).