Suspending an Account

Suspension is the lever you pull when an invoice goes unpaid, when a site is causing a problem, or when a customer asks you to put their hosting on hold. It stops the account from serving without deleting anything — that is deleting the account, a different and irreversible action.

Suspension requires CorePanel Business. On Personal and Pro the control does not appear at all.

Suspending

Accounts → the account’s row → Suspend. The dialog lists exactly what is about to change and offers an optional reason.

The reason is recorded for you and shown in this panel. It is never published: the suspension page a visitor sees says nothing about why. A dunning note is correspondence between you and your customer, not something to put on their homepage.

What suspension does, plane by plane

Plane	While suspended
Websites	Every domain of the account — primary, aliases, addon domains and subdomains — serves a 403 page saying the account is suspended
Applications	Stopped. Applications the owner had already stopped stay stopped
Cron	Jobs stop running. Their definitions are untouched
FTP	Login refused
Mail — sending	Rejected with 550. The account cannot send
Mail — receiving	Keeps working by default, so nothing is lost. Turn keep mail off and senders get a 550 bounce instead
Mail — reading	Works normally. IMAP, POP3 and webmail all keep working
Databases	Left running. The websites in front of them are already down
Files and data	Untouched. Nothing is deleted
Client panel	Sign-in refused, with its own message rather than “wrong password”. Sessions already open are refused on their next request

Why 403 and not 503

A 503 tells search engines and browsers “come back soon” and invites retries; a redirect can be cached by an intermediary long past the end of the suspension. 403 is the honest answer: the server knows the site and is refusing to serve it.

Why the customer can still read their mail

This is deliberate, and it protects the customer more than it looks.

A suspended customer’s mail client keeps polling every few minutes with a password that is perfectly correct. If suspension were enforced by failing the login, every one of those attempts would look like a failed authentication — and the server’s own brute-force protection would eventually block the customer’s IP address. They would then be locked out of the server they are about to pay you for, from an address that might be their whole office.

So sending is cut on the envelope instead: the authentication still succeeds and the message is refused with a clear 550 before it is ever accepted. No component anywhere sees a failed login, the mail client shows the server’s message instead of asking the human to re-enter their password, and reactivating has nothing to unblock.

FTP does refuse the login — but with a reason CorePanel deliberately keeps out of its attack-signal list, so it never counts towards blocking an address either.

Keeping mail flowing

A suspended account keeps receiving mail by default. Messages are delivered to the mailbox as usual and the customer can still read them — over IMAP, POP3 or webmail.

That default is deliberate. Every other plane of a suspension is put back exactly as it was when you reactivate: sites serve again, cron resumes, the applications that were running start again. Bounced mail is the one thing that is gone for good — a customer who pays two days later gets everything back except those two days, and nothing can recover them. So the default errs towards the side you can undo.

If you would rather the sender be told immediately — the honest signal, and what cPanel does — turn keep mail off for that account:

corepanel account update 7 --keep-mail=false

Sending stays blocked either way. This is not a way to soften a suspension, only a choice about whether the outside world is bounced or delivered. The setting is per account: the hosting package does not overwrite a policy you set for one customer.

You can turn it on or off while the account is already suspended, which is usually when you need it: the change reaches the mail server immediately, so the next message either lands or bounces according to what you just set. There is no need to reactivate the account and suspend it again.

Lifting a suspension

Accounts → the account’s row → Reactivate. Websites serve again, cron resumes, mail flows, and the applications that were running when you suspended are started again — only those. An application the owner had stopped themselves stays stopped, because suspension recorded what it actually changed rather than guessing on the way back.

Reactivating is never gated

Suspending requires Business, but reactivating works on every edition. If a licence lapses while an account is suspended, you can always bring the customer’s sites back. A panel that could stop serving a site and then refuse to un-stop it would be holding your customer hostage, not upselling you.

Suspending a whole reseller

If this server hosts for resellers, you can suspend the organisation rather than its customers one at a time. corepanel seller suspend "Acme Hosting" does two things: the reseller’s administrators lose the panel — at the login form and on every request of a session that is already open — and every account it owns is suspended, exactly as described above.

One rule is worth knowing before you use it, because it is what makes the action safe to undo:

An account already suspended in its own right is left alone, and stays suspended when you lift the reseller’s suspension. A customer of Acme who stopped paying Acme three weeks ago is not Acme’s problem to reinstate. The reseller’s suspension records which accounts it took down, and lifting it restores those and nothing else.

The reason you type is recorded on the reseller and shown to you. It never reaches the reseller’s customers: their accounts carry a fixed sentence saying only that the reseller who owns them is suspended. A note about somebody’s unpaid invoice is not something to mail to forty unrelated people.

While a reseller is suspended it is also given no new accounts. Its own staff cannot create any — they cannot sign in — but the CLI, an import and WHMCS all reach the server without one of their sessions, and an account provisioned that way would serve normally under an organisation that is not trading.

The organisation that owns this server cannot be suspended — that would lock every operator, including you, out of the panel.

corepanel seller suspend "Acme Hosting" --reason "unpaid January invoice"
corepanel seller unsuspend "Acme Hosting"

From the command line

# By domain, username, or numeric account id
corepanel account suspend example.com --reason "invoice 4471 unpaid"
corepanel account unsuspend example.com

# The account list marks the state
corepanel account list

See the CLI reference for the full flag list.