Identify the failing password
Identify whether the rejected credential is for the panel, guest root, VNC, SSH key or application. Their changes do not automatically affect one another.
Virtualizor Change Password changes the guest root password only where supported, not panel, VNC, SSH-key or application credentials. Record which login fails, the VPS, message and time; keep any working administrator session open while testing.
This guide covers a Linux VPS that you are authorised to administer. The panel action and the recovery options available to you depend on the installed Virtualizor configuration, guest image and service agreement. For a managed VPS, ask the responsible operator to perform or approve the change under the agreed boundary. Do not enter a root password into a support ticket or a page reached from an unverified link.
Use the panel action only for the correct VPS
Virtualizor documents opening the VPS management page, selecting Change Password and entering a new root password. First confirm the selected VPS and that your service permits this action. Generate a strong, unique password in an approved password manager; avoid reusing your client-area or panel password. Read the confirmation and task status rather than assuming a button click changed the guest.
Virtualizor says an OpenVZ change can take effect immediately, while Xen and KVM changes take effect after a VPS reboot. That is vendor guidance for those technologies, not proof of this VPS's hypervisor or exact task behaviour. If a reboot is required, arrange an authorised maintenance window, check backups and current workload state, and use the agreed graceful reboot path. Do not force repeated restarts to test the password. If you cannot tell whether a reboot is required or permitted, ask Novasean with the task identifier.
Use the symptom to choose the next check
| Observed symptom | Next safe check |
|---|---|
| The Change Password control is absent or disabled | Confirm the selected VPS and account permission; ask whether the service supports a customer-initiated guest password change. |
| The panel reports a failed or unfinished task | Record its exact message and identifier; ask the platform operator to investigate instead of submitting more changes. |
| The panel reports success, but the old guest password still works | Check whether the operation is pending an approved reboot and whether you are testing the same VPS and root account. |
| The new password is rejected at the guest console | Check the correct VPS, keyboard layout and any task or boot error; ask whether the guest image supports the panel operation. |
| The guest console accepts the new password, but SSH does not | Investigate SSH account and authentication policy. A valid guest password does not imply root password login over SSH is allowed. |
For a VPS installed from a custom image or ISO, do not assume the panel can modify the guest account. Virtualizor documents image and template conditions that affect password operations. Have the operator verify the actual image path and supported recovery method; a failed panel operation is not permission to alter boot settings or reset accounts through an unknown rescue image.
Illustrative split: the new password works at the guest console but SSH reports publickey. The guest credential changed; check the approved SSH method without enabling root password login.
Do not weaken SSH to test a password
OpenSSH can reject a root password even when the password is correct inside the guest. Server policy may prohibit root SSH login or password authentication, and a connection ending in Permission denied (publickey) is asking for a public-key method. A timeout or refused connection is a separate network or SSH-service symptom. Ask an authorised administrator to inspect the effective SSH policy and logs for the exact attempt if needed. Do not enable root login, turn on password authentication or loosen a firewall just to make a password test pass.
Use an already approved, lower-privilege account or a permitted console route to confirm access. If you do not have another authorised route, stop experimenting and contact support; the service's recovery boundary determines what can be done. A panel password change does not replace lost SSH keys or prove that the operating system has booted normally.
Prove the change and preserve a recovery path
After the panel task and any authorised reboot have completed, test a fresh login through a permitted method while keeping the existing working session open. Confirm that it reaches the intended VPS and account. Then store the new credential in the approved secret store and remove obsolete copies from staff workflows. If a compromise prompted the change, review other credentials and SSH keys separately with the incident owner; changing the root password alone does not rotate them.
For support, provide the service and VPS identifiers, panel task ID, time and time zone, the exact guest-console or SSH error and whether an existing administrator session remains. Mention whether the VPS uses a provider template or a customer-installed image if known. Share redacted evidence, never the old or new password, private key, recovery code or an unredacted console screenshot. Ask for the supported recovery path before an OS reinstall: reinstalling can erase guest data and does not diagnose why the password action failed.
A panel success message is not a guest login test. Verify through an authorised console or existing account without changing SSH policy.
Common questions
Will changing my Virtualizor account password also change root? No. The account-password and VPS root-password controls are separate.
Must I reboot? Virtualizor documents a reboot for Xen and KVM, but the actual guest technology, task status and operational approval must be checked before acting.
Should I reinstall to regain access? No. Preserve data and determine the approved console or operator recovery route first.
Sources and technical references
Related guides
Was this guide helpful?
If you accepted optional analytics, your Yes/No answer and this guide’s page address are sent to Google Analytics. No written feedback is collected. Read our privacy statement or change your choice in .
Need help with your service?
Open your client area or contact Novasean. Describe the symptom and checks you have performed. Keep passwords, recovery codes and private keys out of your message.