Driver FixRecommendedSound, Wi-Fi or graphics acting up? Check drivers firstFind missing or outdated drivers fast.Check DriversHalloween DealsAmazon USHalloween week deals: useful picks before month-endAmazon US: current deals, useful picks and tech finds.Check DealsSlow PC?RecommendedPC slow today? Run a repair scan before it gets worseResolve common Windows issues and optimize system performance.Scan Now×
Skip to content
World desk20 min

Create and Manage FTP Accounts for your Website

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

FTP accounts give website owners and authorized team members a direct way to upload, edit, and organize site files on a hosting server. They are commonly used for adding images, updating theme or plugin files, moving backups, or giving a developer limited access without sharing the main hosting login.

Creating an FTP account usually involves choosing a username, setting a strong password, assigning the correct directory, and using the provided server details in an FTP client. Careful setup helps prevent accidental changes outside the intended folder and keeps sensitive parts of the website protected.

As an Amazon Associate I earn from qualifying purchases.

Good FTP management also means reviewing accounts regularly, removing access that is no longer needed, using secure connection methods when available, and troubleshooting connection errors with the right host, port, username, and password details.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

What FTP Accounts Are and When to Use Them

An FTP account is a set of login credentials that allows a user to connect to your web hosting account and transfer files between a local computer and the server. FTP stands for File Transfer Protocol, and it is commonly used through desktop clients such as FileZilla, Cyberduck, WinSCP, or a hosting provider’s built-in file manager. With an FTP account, you can upload images, themes, plugins, scripts, documents, and other website files without signing in to the main hosting control panel.

#1 Best Overall
Sale
Lexar D40E 128GB Dual USB 3.2 Gen 1 Type-C Jump Drive, Champagne Silver | USB-C Flash, Metal Housing, Swivel Design, Thumb Drive
  • USB-C 2-in-1 storage OTG: The Lexar JumpDrive Dual Drive D40E features USB Type-A and Type-C connectors in a slim, portable form factor for easy device compatibility
  • Transfer speeds up to 100MB/s: Based on internal testing, performance may vary depending upon the host device, interface, and usage conditions. 1MB=1,000,000 bytes
  • Plug and Play: Widely compatible with USB Type-C smartphones, tablets, laptops, Macs, and traditional Type-A devices, no software installation required. The 360° swivel design allows for easy switching between connectors without the hassle of losing a cap
  • Durable & Compact: The Lexar D40E USB memory stick features a metal enclosure, withstands temperatures from 0° to 50° C (32°F to 122°F), and is lightweight at 26g with dimensions of 70.4 x 16.9 x 11.7mm
  • Security & Warranty: Securely protects files using an advanced security software solution with 256-bit AES encryption. Backed by a Lexar 3-year limited warranty

Most hosting accounts include one primary FTP account tied to the main hosting username. This account usually has broad access to the website’s file system, including folders such as public_html, www, or the document root for your domain. You can also create additional FTP accounts for specific users, projects, domains, or directories. These extra accounts are useful because they let you give someone file access without sharing your main hosting login.

Common situations where FTP is useful

  • Uploading a new website: If you built a static HTML site or received files from a developer, FTP lets you place those files directly in the correct web directory.
  • Updating existing files: You can replace images, CSS files, JavaScript files, PDFs, or template files without using a content management system.
  • Working with developers or agencies: You can create a separate account limited to the folder they need, such as a staging site or theme directory.
  • Managing multiple domains: If your hosting plan contains add-on domains or subdomains, separate FTP accounts can keep access organized by site.
  • Recovering from site issues: If a plugin, theme, or code change breaks your website dashboard, FTP can help you rename or remove the problem files from the server.

FTP accounts are especially helpful when access needs to be practical but restricted. For example, a designer who only updates images does not need access to your email accounts, billing area, databases, or server-wide settings. You can create an FTP account that opens directly into an images or uploads folder. This reduces the chance of accidental changes to application files and makes it easier to revoke access when the work is complete.

It is also useful to understand the difference between FTP, FTPS, and SFTP before deciding how users should connect. Traditional FTP sends data in a less secure way and may not be suitable on public networks. FTPS adds encryption to FTP and is offered by many shared hosting providers. SFTP transfers files over SSH and is common on VPS, cloud, and developer-focused hosting environments. Your hosting provider determines which options are available, so the connection details in your control panel should be used as the source of truth.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

You should use FTP accounts when you need controlled file-level access to a website. You should avoid using them as a replacement for full hosting administration, database management, or application-level user roles. For example, a WordPress editor account is better for publishing blog posts, while an FTP account is better for uploading a custom theme, replacing a broken plugin folder, or maintaining static assets. Choosing the right type of access keeps your website easier to manage and safer over time.

Prerequisites Before Creating an FTP Account

Before you add a new FTP account, gather the details and access you need so the account is created with the correct scope from the start. Most hosting providers let you create FTP users from a control panel such as cPanel, Plesk, DirectAdmin, or a custom hosting dashboard. You should be able to sign in as the hosting account owner or as an administrator with permission to manage FTP users, domains, and file access.

Confirm which website or domain the FTP account will be used for. On shared hosting, one account may contain several domains, subdomains, or staging sites, each with its own document root. Common paths include public_html for the primary site, a domain-specific folder such as example.com, or a subdomain folder such as staging.example.com. Choosing the right path matters because it controls which files the FTP user can view, upload, edit, or delete.

Information to have ready

  • Control panel login: Access to the hosting dashboard where FTP accounts are managed.
  • Target domain or subdomain: The exact site the account should maintain.
  • Directory path: The folder the FTP user should be limited to, such as /public_html/assets or /public_html/wp-content/themes.
  • Username format: Some hosts require a full username like [email protected], while others use a plain username.
  • Strong password: Use a long, unique password generated by a password manager.
  • Storage quota: Decide whether the user needs unlimited space or a fixed limit for uploads.

You should also decide the account’s purpose before creating it. A developer updating theme files may need access only to a theme directory, while a content team uploading PDFs may need access only to an uploads or media folder. Avoid giving every user access to the whole website unless they truly need it. Limiting each account to the smallest practical directory reduces the risk of accidental file changes and helps contain damage if credentials are exposed.

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Check whether your host supports secure transfer methods such as SFTP or FTPS. Traditional FTP sends credentials and data without encryption, so it is not suitable for untrusted networks. Some hosting plans provide SFTP through SSH access rather than the FTP account manager, while others offer FTPS from the same FTP section. If secure FTP requires enabling SSH, adding an SSH key, or opening a specific port, complete those steps before giving the connection details to the user.

Rank #2
SANDISK 128GB Ultra Flair, USB-A Flash Drive, Up to 150MB/s Read Speeds | USB Flash Drive, Up to 15x Faster than standard 2.0, Password Protection, Durable, Sleek Metal Casing, USB 3.0, Silver/Black
  • High-speed USB 3.0 performance of up to 150MB/s(1) [(1) Write to drive up to 15x faster than standard USB 2.0 drives (4MB/s); varies by drive capacity. Up to 150MB/s read speed. USB 3.0 port required. Based on internal testing; performance may be lower depending on host device, usage conditions, and other factors; 1MB=1,000,000 bytes]
  • Transfer a full-length movie in less than 30 seconds(2) [(2) Based on 1.2GB MPEG-4 video transfer with USB 3.0 host device. Results may vary based on host device, file attributes and other factors]
  • Transfer to drive up to 15 times faster than standard USB 2.0 drives(1)
  • Sleek, durable metal casing
  • Easy-to-use password protection for your private files(3) [(3)Password protection uses 128-bit AES encryption and is supported by Windows 7, Windows 8, Windows 10, and Mac OS X v10.9 plus; Software download required for Mac, visit the SanDisk SecureAccess support page]

Finally, make sure you know the correct server connection details. These usually include the FTP hostname, port, protocol, and initial directory. The hostname may be your domain name, such as ftp.example.com, or a server name provided by the host. Standard FTP commonly uses port 21, FTPS often uses 21 or 990, and SFTP uses port 22. Having these details ready makes it easier to test the new account immediately after creation and confirm it opens only the intended folder.

How to Create a New FTP Account

Most hosting providers let you create FTP accounts from a control panel such as cPanel, Plesk, DirectAdmin, or a custom dashboard. The labels vary, but the workflow is usually the same: open the FTP management area, choose a username, set a strong password, assign the account to a specific folder, and save the account. Before you begin, sign in to your hosting dashboard with an administrator or owner-level login so you have permission to create new file access accounts.

Creating an FTP account in a typical hosting control panel

  1. Open the FTP section: In cPanel, look for FTP Accounts under the Files section. In Plesk, go to Websites & Domains, choose the domain, then open FTP Access. Other panels may use labels such as File Transfer, FTP Users, or Site Access.
  2. Select the website or domain: If your hosting plan includes multiple domains, choose the domain the account should access. This prevents the FTP user from being attached to the wrong site.
  3. Enter a username: Use a clear name that identifies the purpose of the account, such as designer, staging-upload, or client-assets. Many hosts append the domain automatically, producing a full login such as [email protected].
  4. Create a strong password: Use the password generator if your panel provides one. A good FTP password should be long, unique, and not reused from your hosting login, CMS admin account, or email account.
  5. Set the home directory: Choose the folder where this FTP account should start and remain confined, such as public_html, public_html/wp-content/uploads, or a specific project folder.
  6. Apply storage limits if available: Some panels let you set a quota. Use a quota when the account is for temporary uploads, client file delivery, or limited media work.
  7. Save or create the account: After submitting the form, the control panel should display the new FTP account in the account list.

The directory setting is one of the most choices during account creation. If the account is for a developer maintaining the whole website, its directory may need to be the site root, commonly public_html, www, or the domain’s document root. If the account is only for uploading images, documents, or theme assets, restrict it to the exact folder needed. For example, a content editor who only uploads PDFs might only need access to public_html/files, not the entire website.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Account purpose Suggested directory Access level
Full site maintenance public_html or domain root Broad access to website files
Media uploads public_html/uploads or CMS upload folder Limited to uploaded assets
Theme or template work Theme, template, or assets directory Limited to design files
Temporary contractor access Project-specific folder Restricted and easy to remove later

After the account is created, record the connection details securely. You will usually need the FTP hostname, username, password, port, and protocol. The hostname is often your domain name, such as example.com, or a server name provided by the host. Standard FTP commonly uses port 21, while SFTP commonly uses port 22. If your host supports FTPS or SFTP, choose that option when possible because it encrypts the login and file transfer session.

Before sharing the account with a developer, designer, or team member, test the login in an FTP client to confirm that the credentials work and that the user lands in the intended directory. If the account opens into the wrong folder, edit the account immediately rather than relying on the user to avoid sensitive directories. Once verified, send the credentials through a secure password manager or encrypted sharing method instead of plain email or chat.

Setting Directory Access and Permissions

After creating an FTP account, the most configuration is the directory the account can access. This setting controls the account’s starting folder and usually limits the user to that folder and its subfolders. For example, an account assigned to /public_html/images should be able to upload, rename, and delete files inside the images folder, but should not browse your entire hosting account or edit unrelated website files.

Most hosting control panels provide a Directory, Path, or Home Directory field when you create or edit an FTP account. If you are using cPanel, Plesk, DirectAdmin, or a similar panel, the path is often suggested automatically based on the FTP username. Review it carefully before saving. For a developer working on the whole website, you might set the directory to /public_html. For a designer updating only media assets, use a narrower path such as /public_html/wp-content/uploads or /public_html/assets.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Choosing the right directory scope

  • Full website access: Use /public_html only for trusted users who need to manage the live site’s files.
  • Single project folder: Use a path such as /public_html/client-area for someone maintaining one section of the site.
  • Uploads only: Use a media or downloads folder when a user only needs to add images, PDFs, or other files.
  • Staging access: Use a staging directory such as /staging or /public_html/staging to keep test work separate from production files.

File and folder permissions determine what the FTP user can do after connecting. On Linux-based hosting, permissions are commonly shown as numbers. A typical safe setting is 644 for files and 755 for directories. This usually allows the owner to write files while allowing the web server to read them. Avoid setting files or folders to 777 unless your host specifically requires it for a short-term diagnostic task, because it grants broad write access and can expose the site to unwanted changes.

Rank #3
Sale
2 Pack 64GB USB Flash Drive USB 2.0 Thumb Drives Jump Drive Fold Storage Memory Stick Swivel Design - Black
  • What You Get - 2 pack 64GB genuine USB 2.0 flash drives, 12-month warranty and lifetime friendly customer service
  • Great for All Ages and Purposes – the thumb drives are suitable for storing digital data for school, business or daily usage. Apply to data storage of music, photos, movies and other files
  • Easy to Use - Plug and play USB memory stick, no need to install any software. Support Windows 7 / 8 / 10 / Vista / XP / Unix / 2000 / ME / NT Linux and Mac OS, compatible with USB 2.0 and 1.1 ports
  • Convenient Design - 360°metal swivel cap with matt surface and ring designed zip drive can protect USB connector, avoid to leave your fingerprint and easily attach to your key chain to avoid from losing and for easy carrying
  • Brand Yourself - Brand the flash drive with your company's name and provide company's overview, policies, etc. to the newly joined employees or your customers
Permission Common use Effect
644 Website files such as HTML, CSS, JS, and images Owner can edit; others can read
755 Directories and executable folders Owner can edit; others can read and enter the folder
600 Sensitive configuration files Only the owner can read and write
777 Rare temporary troubleshooting cases Everyone can read, write, and execute

When assigning access, use the smallest directory scope that lets the person complete their work. If an FTP account is only meant to update a theme, point it to that theme folder rather than the entire hosting account. If the user reports “permission denied” errors, check whether the account is restricted to the wrong directory, whether the destination folder is owned by a different system user, or whether the folder permissions block uploads. Many control panels include a file manager where you can confirm paths and adjust permissions without using an FTP client.

Before handing over credentials, test the account yourself with an FTP client. Confirm that the user lands in the expected folder, cannot move upward into private directories, and can only upload or edit the files they are supposed to manage. This short test helps prevent accidental deletion of core files, exposure of backups, and changes to email, database, or application configuration files stored outside the intended website directory.

Connecting to Your Website with an FTP Client

After creating the FTP account and assigning its directory access, the next step is to connect with an FTP client such as FileZilla, Cyberduck, WinSCP, or Transmit. These applications let you browse your local computer on one side and your website’s server files on the other, then upload, download, rename, move, or delete files as needed. Before connecting, keep your FTP username, password, server hostname, port number, and protocol ready from your hosting control panel or welcome email.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Most FTP clients use a similar connection form. Open the client’s site manager or new connection window, then enter the details provided by your host. The hostname is often your domain name, such as example.com, or a server address such as ftp.example.com. The username may look like a full email address, a cPanel-style login such as [email protected], or a short account name. The password is the one you set when creating the FTP account.

Field What to Enter
Protocol Use SFTP if available, otherwise FTPS or standard FTP only when required.
Host Your domain, FTP subdomain, or server hostname provided by the hosting account.
Port 22 for SFTP, 21 for FTP/FTPS, unless your host specifies another port.
Username The exact FTP account username from your control panel.
Password The password assigned to that FTP account.

When the connection succeeds, the remote panel will display the folder assigned to the FTP account. If the account was restricted to a specific directory, the user may not see the whole hosting account, only the allowed folder and its contents. For a typical website, public web files are often stored in a directory named public_html, www, htdocs, or a domain-specific folder. Upload site files into the correct document root so they become accessible through the browser.

To upload files, select them from the local panel and drag them into the correct remote folder. Many FTP clients also support transfer queues, overwrite prompts, and resume options for larger uploads. Pay close attention when replacing files such as index.php, .htaccess, configuration files, images, or theme assets. If you are updating an existing website, download a backup copy of the original file before overwriting it so you can restore it quickly if the change causes an error.

Common Connection Problems

  • Authentication failed: Recheck the username format, reset the FTP password, and confirm the account has not been suspended or deleted.
  • Connection timed out: Verify the hostname and port, check your internet connection, and confirm your firewall or office network is not blocking FTP traffic.
  • Directory not found: Confirm that the FTP account’s home directory still exists and that the path was typed correctly in the control panel.
  • Permission denied: The account may not have write access to the target folder, or the file may be owned by another system user.
  • TLS certificate warning: Check that the certificate belongs to your hosting provider or domain before accepting it.

If plain FTP connects but secure FTP does not, check which secure method your host supports. SFTP runs over SSH and usually uses port 22, while FTPS is FTP with TLS encryption and usually uses port 21. These are not interchangeable settings in most clients. Once your details are confirmed, save the connection profile in the client’s site manager, but avoid saving passwords on shared or public computers.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Managing, Updating, and Deleting FTP Accounts

After an FTP account is created, it should be reviewed regularly just like email accounts, database users, and control panel logins. FTP access often provides direct access to website files, so old accounts, weak passwords, or overly broad directory access can create unnecessary risk. Most hosting control panels include an FTP Accounts area where you can view existing users, check their assigned directories, change passwords, adjust quotas, and remove accounts that are no longer needed.

Rank #4
Sale
SIMMAX 32GB Memory Stick USB 2.0 Flash Drives Swivel Thumb Drive Pen Drive (32GB Purple)
  • GOOD VALUE PACKAGE - 1 Pack 32GB Memory Stick USB 2.0 Flash Drives with great cost performance and high quality.
  • BIG CAPACITY - The available capacity: 29.10GB-29.8GB, You can save the data of movies, music, photos, designs, programs, manuals, handouts in a high speed.Good performance in digital data storing, transferring and sharing with families, friends, workmates, clients and machines.
  • EASY TO USE & PLUG AND WORK - Support windows 7 / 8 / 10 / Vista / XP / 2000 / ME / NT Linux and Mac OS, Compatible with USB2.0 and below.
  • TWISTTURN DESIGN & EASY CARRY - The metal clip rotates 360° round the ABS plastic body which with rubber oil skin feeling finish. The capless design can avoid lossing of cap, and providing efficient protection to the USB port.
  • WARRANTY & SUPPORT - SIMMAX logo is laser printed on the USB connector surface, our products are of good quality and we promise that any problem about the product within one year since you buy.

Review existing FTP accounts

In cPanel, Plesk, DirectAdmin, and many custom hosting dashboards, you can usually find FTP users under sections such as FTP Accounts, Web Hosting Access, or Files. The account list normally shows the FTP username, home directory, disk quota, and available actions. When reviewing accounts, confirm that each one still has a clear purpose. For example, an account for a former developer, an old staging site, or a one-time migration should be disabled or deleted after the work is finished.

  • Username: Confirm who owns the account and whether it is still in use.
  • Directory: Check that the user is limited to the correct folder, such as /public_html/client-upload/ instead of the entire website root.
  • Quota: Make sure the storage limit fits the task and does not allow uncontrolled uploads.
  • Last use: If your host shows login history, look for accounts that have been inactive for a long time.

Update passwords, quotas, and access paths

To update an FTP account, choose the edit, change password, or configure option beside the user in your hosting panel. Password changes are common after a team member leaves, after sharing credentials with a contractor, or after a malware cleanup. Use a long, unique password generated by a password manager, then update the saved connection profile in FileZilla, Cyberduck, WinSCP, or your preferred FTP client. If the FTP client keeps failing after a password change, remove the saved password and re-enter the full username exactly as shown in the hosting panel.

Some panels allow you to change an account’s directory, while others require you to delete the account and recreate it with the new path. Be careful when changing directory access for active workflows. A designer uploading theme files may need access to /wp-content/themes/, while a content assistant may only need an uploads folder. Disk quotas can also be adjusted when a user receives storage errors during uploads, but avoid setting unlimited quotas unless the account is trusted and closely monitored.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Delete accounts safely

Deleting an FTP account usually removes the login credentials, not the website files inside the assigned folder. Still, control panels can vary, so read the confirmation message before accepting. Some interfaces offer choices such as deleting only the FTP user or deleting the user and the associated home directory. If there is any uncertainty, back up the directory first or download a copy of the files before removal.

  1. Identify the FTP account and confirm it is no longer required.
  2. Check whether any automated task, deployment script, or team member still uses it.
  3. Back up relevant files if the panel offers to remove the user’s directory.
  4. Delete the account from the FTP Accounts page.
  5. Test the old credentials to confirm they no longer connect.

If you are troubleshooting access problems, compare the account settings with the FTP client configuration. Login failures are often caused by an incorrect username format, an outdated password, the wrong protocol, or using the wrong port. Standard FTP commonly uses port 21, while SFTP often uses port 22 and may require a separate SSH-enabled user. If uploads fail after login, check directory permissions, disk quota, available hosting storage, and whether the user is confined to a folder that does not include the target path.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

FTP Security Best Practices

FTP access can change, replace, or remove live website files, so each account should be treated like an administrator-level credential for the directories it can reach. The safest setup is to give every user or application its own FTP account, restrict that account to the smallest required folder, and remove access as soon as it is no longer needed. Avoid sharing one general login between developers, designers, and staff members because shared credentials make it difficult to track changes or revoke access for one person.

Use secure connection methods whenever available

Standard FTP sends usernames, passwords, and file data without encryption. If your hosting provider supports it, use SFTP or FTPS instead. SFTP usually connects over port 22 and uses SSH-based encryption, while FTPS commonly uses port 21 or a provider-specific secure FTP port with TLS encryption. In your FTP client, select the secure protocol offered by your host and enable certificate verification when prompted. If you are unsure which option your server supports, check the hosting control panel’s FTP section or the provider’s connection settings page.

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
  • Prefer SFTP or FTPS: Use encrypted transfers instead of plain FTP where possible.
  • Avoid saving passwords on shared computers: If credentials must be stored, use a trusted password manager rather than browser-style saved logins in the FTP client.
  • Check the host and port: Confirm you are connecting to the correct server, especially after migrations or DNS changes.
  • Review certificate warnings: Do not ignore unexpected certificate changes unless your host confirms the update.

Limit account scope and file permissions

Directory restrictions are one of the most effective ways to reduce damage from mistakes or compromised credentials. A developer who only updates a theme should not need access to email folders, backups, logs, or unrelated websites on the same hosting account. For a typical website, public files may be stored in folders such as public_html, www, or a domain-specific directory. Create FTP accounts that open directly inside the required project folder rather than the hosting account root.

Best Value
IMEASON Swivel Design 16GB USB Flash Drive with Keychain, USB 2.0 Portable Thumb Drive Memory Stick, FAT32 Format Flashdrive for Data Storage, Photos, Music, Files (Black, 16 GB)
  • 【16GB Flash Drive】USB flash drives with 16GB capacity, meet your needs of daily use on work, school, home and travelling for photos, music, videos, files storage and transfer. IMEASON thumb drives can be used to store different files, easy to data backup.
  • 【Metal Swivel Cap Design】USB thumb drive is metal swivel cover provides extra protection for the usb thumbdrive connector, no usb drive cap to lose; keychain design makes it easier to carry without worrying lose it.
  • 【Wide Compatibility】USB drive supports Windows 7/8/10/11 / Vista / XP / Unix / 2000 / ME / NT Linux and Mac OS, also Supports USB 2.0 and 1.1 ports. USB Stick support TV, desktop, notebook computer, car, audio and other device. The USB Memory Stick is your great data storage and transfer companion with traveling and working.
  • 【Easy to use】usb memory stick is plug and play without any software installation. Just simply plug the Flashdrive into the port of your USB-compatible devices such as computer, laptop to start data storage or transmission.
  • 【What You Get】16 GB USB Flash Drive Thumb Drive, The default format of the usb storage flash drive is FAT32.

File permissions should also stay conservative. Common website permissions are often 644 for files and 755 for folders, though your application or host may require different settings. Avoid setting files or directories to 777 unless your hosting provider specifically instructs you to do so for a temporary diagnostic step. Overly open permissions can allow scripts, plugins, or other users on poorly isolated systems to modify files they should not control.

Maintain credentials and monitor access

Use long, unique passwords for every FTP account, ideally generated by a password manager. Change passwords after a contractor finishes work, after sending credentials through an insecure channel, or after any sign of suspicious file changes. If your control panel includes last-login details, FTP session logs, or file manager activity logs, review them during routine maintenance and after major updates. Unexpected uploads, unfamiliar IP addresses, or modified files with odd timestamps can indicate a compromised account.

  1. Create separate FTP accounts for each person, project, or deployment tool.
  2. Restrict each account to the exact directory it needs.
  3. Use SFTP or FTPS instead of unencrypted FTP.
  4. Rotate passwords when team members or vendors change.
  5. Delete unused accounts rather than leaving them disabled indefinitely.

For additional protection, enable hosting features such as two-factor authentication for the control panel, IP allowlisting for FTP access if available, and malware scanning for uploaded files. Keep local computers clean as well, because many FTP compromises start with malware stealing saved credentials from an infected workstation. A secure FTP workflow combines encrypted connections, narrow permissions, strong passwords, and regular account cleanup.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Frequently Asked Questions

What FTP host, username, port, and path should I use to connect to my website?

Your FTP host is usually your domain name, server hostname, or the IP address shown in your hosting control panel. Standard FTP typically uses port 21, while SFTP often uses port 22, and FTPS may also use port 21 depending on the host. The correct path depends on the account’s directory access, but public website files are commonly stored in folders such as public_html, www, or your domain’s document root.

Should I create one FTP account for everyone or separate accounts for each user?

Create separate FTP accounts for each developer, contractor, or team member instead of sharing one login. This makes it easier to limit each person’s access, change or revoke access later, and track who was responsible for file changes. If someone only needs to work on one site folder, restrict their account to that specific directory.

How do I stop an FTP user from accessing my entire website?

When creating or editing the FTP account, set its home directory to the exact folder the user needs, such as /public_html/images or a staging site directory. Many hosting panels automatically “jail” the user to that folder so they cannot browse above it. If your panel has permission settings, avoid granting write or delete access unless the user truly needs to upload or modify files.

What should I do if my FTP login works but I cannot upload or edit files?

Check that the FTP account has write permission for the folder you are trying to modify. Also confirm the target directory and files are owned by the correct hosting user and are not set to read-only permissions. If uploads fail only for large files, your hosting account may have disk quota limits, file size restrictions, or a temporary server-side issue.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Is FTP safe to use, or should I use SFTP or FTPS instead?

Plain FTP sends login credentials and file data without encryption, so it is not recommended on public or shared networks. Use SFTP or FTPS if your hosting provider supports it, and confirm the correct protocol and port in your FTP client. For better security, use strong unique passwords, remove unused accounts, and avoid saving passwords on shared computers.

Bottom Line

FTP accounts make it easier to upload, update, and maintain website files, but they should be created with care. Use the right directory access, strong unique passwords, and secure connection methods like SFTP or FTPS whenever your hosting provider supports them.

Review your FTP users regularly, remove accounts that are no longer needed, and limit permissions to only what each person or tool requires. If connection issues come up, double-check the hostname, port, username format, password, and firewall settings before contacting your host for help.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Leave a Reply

Your email address will not be published. Required fields are marked *

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

More from the Wire

  1. World desk4 min
    How to Spot an AI Voice Scam Before Sending MoneyDon’t rely on how a caller sounds. Pause, call back through a known number, and verify the emergency with another trusted person before sending money.
  2. Mountain View desk4 min
    Google’s SynthID Detector: How to Check AI-Generated Images, Video and AudioGoogle’s SynthID Detector looks for an embedded watermark in supported images, video and audio. Here is what its results do—and do not—show.
  3. Redmond desk20 min
    How to create a link to File or Folder in Windows 11Windows 11 gives you several ways to point to a file or folder without moving or duplicating it. You can create a desktop shortcut,…
Recommended PC Tool
Recommended PC Tool
Crashes, No Sound, or Screen Glitches?Free driver scan
PC Slower Than It Used to Be?Free scan - under a minute

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.