Site Access & Isolation
Give a developer or a customer access to one website, not the whole server. Nodekeeper keeps four things apart: site access and host access, panel accounts and site runtime users, file permissions and processes, and who may do something versus who owns it.
All plans, including Free Site isolation and site SSH / FTP are included in every plan. Groups and delegated roles start at Pro.
Site SSH is served by a separate Nodekeeper SSH service, not by the host's own sshd. A site SSH account is a virtual access mechanism that Nodekeeper manages. It is not a virtual machine, a container or a separate kernel.
Host access stays with the administrator. In the panel you configure the host's SSH service, authorised keys and two-factor authentication. These settings are separate from site grants: giving someone site SSH never adds them to the host's SSH configuration.
Each site's FTP service runs as that site's user, so it reaches only that site's files. The password is shown once, when it is created or reset.
A member logs in to the panel with a panel account. Each site's code runs as that site's own system user and group, which no other site shares. One panel administrator is not one mailbox, database or site user.
The site root is owned by root, so a site cannot open its own boundary even if it sets its files to 0777. PHP-FPM gets one pool per site. Apache (mod_php) gets one instance per site by default. Each site's runtime logs can be read only by that site's user and root.
Archives that are extracted or restored in the panel never produce symbolic or hard links. Such entries, ../ paths and absolute paths are skipped and listed. nginx does not follow a link that points to files owned by another user.
Permission codes decide what an account may do. Every request also checks who owns the resource. Member accounts are free. User groups, roles and delegation (Multi-user and permissions) start at Pro.
On 2026-11-03 we tested the November 2026 release from the member panel, with two members and several sites. Each member tried to reach the other's sites, files, scheduled tasks, SSH grants, FTP, PHP pools and their logs, backups, domains, WAF logs, reverse-proxy and forwarding rules. All of these requests were refused.
For another member's resource, the refusal is byte-for-byte the same as for an ID that does not exist, so members cannot discover what others own. The isolation check script passed 72 of 72 checks, including the case where a site had made all its files 0777.