What you need
- A server running Ubuntu 22.04 or 24.04, or Debian 12 or 13, with
python3(Ubuntu ships it). - A root shell on it once, to add the key line.
- Its SSH port reachable from Hostio's addresses.
- The owner or admin role in your Hostio team.
1. Create the team key
Open the user menu → Team SSH key and press Generate key. Do this once: every server of the team uses the same ED25519 key. Its private half is stored encrypted and never shown.
2. Add the server
Go to Servers → Add server. Name, IPv4 address and SSH port (default 22) are required; a hostname, an IPv6 address and the operating system are optional. Hostio logs in as root; you can change the SSH user later under Edit → Connection.
The free Health plan covers 2 servers, Pro 10 and Agency 50 (pricing).
3. Authorize the key
The server's page shows one command under Authorize Hostio. Run it once as root on the server. It adds the team key to /root/.ssh/authorized_keys; running it twice changes nothing. The line it adds looks like this:
from="80.47.228.240,2a04:3542:1000:910:7cd7:1dff:fe8b:9a4",no-agent-forwarding,no-X11-forwarding,no-port-forwarding ssh-ed25519 AAAAC3Nz… hostio@your-teamThe from= part lets the key in only from Hostio's control plane addresses, so a copy of the key is useless anywhere else. More on security.
4. Test the connection and pin the host key
Press Test connection. Hostio checks the hostname (if you gave one), the SSH port, the SSH banner and the key login. It changes nothing on the server.
Then press Pin host key and compare the fingerprint it shows with the server's own:
ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pubIf they match, pin it. Hostio tests again and the server becomes ready. From then on Hostio refuses to connect if the server's host key changes.
More → Run probe shows the operating system, kernel, CPU, memory, disk, nginx, PHP versions and services right away, read-only.
5. The first scan
Hostio scans every server four times a day, at 02:15, 08:15, 14:15 and 20:15 UTC, so the first scan arrives within six hours. The scan is read-only and runs at low priority. From your applications' .env and wp-config.php it takes only queue settings, the number of scheduled tasks and a hash of the database name; never a password.
After it, the server's Overview counts sites, PHP pools, daemons, cron jobs, certificates and open insights. Insights lists what the scan found, danger first; each insight closes by itself when a later scan no longer finds it. See all checks.
What Hostio changes
On Health, nothing: only read-only work runs, anything else is refused. On Pro and Agency every change is an operation you preview first, with a backup and a one-step roll back. The optional agent (Pro) sends metrics outwards every minute; it runs as its own user, with no shell and no sudo.