Onboard a customer in one step
Create Account provisions the account, website, DNS zone and FTP login together, then hands you a paste-ready summary of every credential.
What it does
Admin → Create Account sets up a complete hosting account from a single form. You type a domain; NovaPanel creates:
- the customer account and its Linux user, home directory and starter pages
- a website, with the domain attached and its virtual host live
- a DNS zone with A and www records (and DNSSEC, if you've enabled it)
- an FTP login for the account, using the same password as the account itself
- an SSL certificate, when the domain already points at this server
It finishes on a summary screen containing every credential and setting, with a Copy all button. That block is meant to be pasted straight into an email to the account owner.
The summary is the only time the password is shown — copy it before you leave the page. It is stored as a bcrypt hash and cannot be recovered. The FTP login uses the same password, the way cPanel does, so there is one credential to hand over rather than two; changing the account's password changes the FTP password with it. If it is lost, set a new one from the customer's account.
The form
Domain
Type this first — everything else is derived from it. Use the bare domain
(example.com), not www. and not a URL.
Username
Optional. The greyed-out name in the field is only a preview of what the domain would give you
— it is never submitted. Leave the field empty and the server derives the real username from the
domain: example.com becomes example, with a number appended if that name
is already taken. Type your own if you'd rather choose.
This is a real Linux user on the server, so it must be 2 to 32 characters, start with a lowercase
letter, end with a letter or a digit, and contain only lowercase letters, digits, -
or _. Reserved system names — root, admin, user,
ftp, www-data, novapanel, postgres and the like
— are rejected.
Password
Leave it blank. NovaPanel then generates a strong random password on the server, which is the safer default. The Generate button is there only if you want to see or adjust the password before creating the account.
Contact email
The customer's own address — where you'd send the handover. This is also the account's login
identity. If you leave it blank it defaults to admin@ the domain.
Package
Applies that package's limits and disk quota immediately. Leave it as No package to use the server defaults. Packages are managed under Admin → Packages.
DNS and FTP toggles
Both on by default. Turn DNS off when the domain's DNS stays at the registrar or Cloudflare and you don't want NovaPanel to be authoritative — see Configure DNS for a new domain. Turn FTP off if the customer will only use the File Manager.
Mailboxes are not created
Deliberately. Most customers route mail elsewhere (Google Workspace, Microsoft 365, their registrar), and an unused mailbox is just another spam target with a password to manage. When a customer does want mail, add it from their Email page — see Set up email for a customer.
Reading the result
Under the credentials you'll see a list of what was set up, with a mark against each step:
- Tick — done.
- Dash — skipped, because you turned that toggle off (or the service isn't installed on this server).
- Amber warning triangle — blocked, because the package you chose sets that limit to zero, so the step was never allowed to run.
- Cross — that step failed, and the reason is shown next to it.
Provisioning is deliberately step-by-step, but the steps are not all equal. The site and domain steps are load-bearing: if either fails or is blocked, everything after it is abandoned, so you can be left with an account and its home directory but no domain, no virtual host, no DNS zone and no FTP login. Delete it and start again rather than trying to patch it up. Failures further down are genuinely recoverable — if the virtual host, the DNS zone or the FTP login fails, the rest still runs and you can add the missing piece by hand afterwards.
After creating the account
- Point the domain at the server. Either set the customer's nameservers to the ones shown in the summary, or add an A record for the domain pointing at the server IP.
- SSL, only if the summary says it was skipped. A certificate is requested during provisioning when the domain already points here, and the summary's SSL line says so either way. If the domain was not pointed yet, wait for DNS to resolve and issue the certificate from the customer's SSL page — Let's Encrypt has to reach the domain over HTTP, which is exactly why provisioning does not attempt it blindly.
- Send the handover. Use Copy all and paste it into your welcome email.
Behind Cloudflare? Leave the orange cloud off until the certificate is issued, or Let's Encrypt cannot validate the domain. See Running behind Cloudflare.
Create Account vs Users → Create User
Both still exist, and they're for different jobs:
- Create Account — for a hosting customer. Provisions a website, DNS and FTP, and gives you the handover summary.
- Users → Create User — for an account you'll fill in later, or for staff. It runs the same account setup underneath, so a customer created this way still gets its Linux user, home directory, starter pages and disk quota; it just skips the site, domain, DNS and FTP steps, and there's no handover summary. Use it for another administrator of the panel itself, or when the customer's domain isn't settled yet.
If something goes wrong
"Could not derive a username from that domain" — the domain's first label has no usable letters (for example a purely numeric one). Type a username yourself.
An amber warning about the system user — the account exists but its Linux user could not be created, so file, FTP and deploy features will not work yet. NovaPanel retries automatically the first time the customer uses those features. If it keeps failing, delete the account and recreate it, and check the server has room for another user.
The domain already exists — a domain can only be attached to one account on a server. Remove it from the other account first, or use a different domain.