Skip to main content

Announcing the Removal of Password-Based SSH Logins in MODX Cloud

  • Updated
Announced On Rollout On
November 13, 2026 November 30, 2026

Starting on November 30, 2026, MODX Cloud will stop accepting passwords for SSH connections. Access over SSH will be by SSH key only.

This announcement includes the following topics:

  • What is changing?
  • Why is MODX making this change?
  • What do I need to do?
  • Related documentation

What is changing?

Password authentication is being turned off for every type of SSH connection to MODX Cloud. This affects any tool that signs in with your Cloud's SSH/SFTP username and password, including:

  • SSH sessions from a terminal or an SSH client
  • SFTP clients such as FileZilla, Cyberduck, Transmit, WinSCP and the SFTP features built into code editors
  • Database clients that connect through an SSH tunnel, such as HeidiSQL, Sequel Ace, DBeaver, Beekeeper Studio and DbGate
  • rsync, scp, Git over SSH, deployment scripts, backup jobs and any other automation that connects to a Cloud

After November 30, a connection that offers a password will be refused. Connections that present an SSH key held in a MODX Cloud user profile will continue to work as they do today.

The SSH/SFTP password field is also being removed from the Cloud Edit page on the same date, since it will no longer do anything. Your Cloud's SSH username stays where it is, in the SSH/SFTP section at the bottom of that page.

This change applies only to SSH. Your MySQL password is unchanged and is still required by your database client once the SSH tunnel is open, and MODX Cloud Dashboard logins are not affected.

Why is MODX making this change?

There are two reasons.

Security. Automated credential attacks have become cheaper, faster and better targeted with the arrival of widely available AI tooling. A password that was adequate a few years ago no longer carries acceptable risk on an internet-facing SSH service. SSH keys are not guessable in the same way.

Key-based access is also easier to control. Account owners no longer have to hand out a Cloud's SSH password to give a developer, contractor or agency access, and no longer have to track who holds it. Each person connects with their own key, access follows the permissions their user account already holds, and removing a user removes their SSH access immediately—with no password to roll afterward.

Reliability. Our servers field constant password-login attempts from bots and misconfigured scripts. Each attempt holds a connection slot open for several seconds while the password exchange runs and then times out. SSH limits how many unauthenticated connections can be in progress at once, so when enough of those attempts overlap, connections from legitimate users are refused before they reach a login prompt. That is the cause of the intermittent "can't connect" reports we see. With passwords no longer accepted, these attempts are rejected immediately rather than tying up a slot, so that limit is far less likely to be reached.

What do I need to do?

If you already connect to your Clouds with an SSH key, nothing. If you or anyone on your team still connects with a password, work through the following before November 30, 2026.

  1. Create an SSH key pair if you don't already have one.
  2. Add the public key to your MODX Cloud profile, under Profile → SSH Keys. It then works on every Cloud your account has permission to access, present and future, with no per-Cloud setup.
  3. Point your clients at your private key. In SFTP and database clients, replace the saved password with the path to your private key file, and update any script or automation that stores a password.
  4. Make sure everyone who needs SSH access has a key in place. The preferred route is a MODX Cloud user account with their own key, which gives them exactly the access their permissions allow and nothing more. For a collaborator without an account, an account owner can add their public key to an individual Cloud instead.
  5. Test your connections now, rather than on November 30.

Full instructions for creating a key pair and adding it to your profile are in Use SSH Keys to Access Clouds. To give a collaborator access to a single Cloud, see SSH & SFTP Using SSH Keypairs on Individual Cloud Instances. Profile-based keys are the preferred method—a key added to a single Cloud isn't removed automatically when that person's access ends.

Related documentation

If you need help getting a key set up, use the Help button in the MODX Cloud Dashboard and our support team will walk you through it.

Related articles