A developer needs to upload files to one folder on your site. A client wants to drop product photos into an images directory. Do you really want to hand either of them your main cPanel password? You shouldn't — and you don't have to. cPanel lets you create scoped FTP and SFTP accounts that are locked to a single directory, so people (and scripts) can move files without ever touching the rest of your hosting account. Here's how to set it up properly, plus the mistakes that quietly turn a convenience feature into a security hole.
FTP vs SFTP: Which One Should You Actually Use?
These two get lumped together, but they're not the same protocol, and the difference matters more than most setup guides let on.
- FTP sends your username, password, and file contents in plain text. Anyone sniffing traffic on an open Wi-Fi network or a compromised router can read the credentials. It's also the protocol most often blocked by corporate firewalls, which is why it fails intermittently for some users and not others.
- SFTP (SSH File Transfer Protocol) tunnels everything over SSH, so it's encrypted end to end. It uses port 22 by default — the same port as your SSH access — instead of port 21 plus a range of passive ports.
If your plan has SSH access enabled, use SFTP. It's not a separate account type in cPanel — any user with shell access, or an FTP account combined with cPanel's Jailed Shell feature, can connect over SFTP using the same credentials. On shared hosting where SSH is disabled, plain FTP is often the only option, so at minimum use FTPS (FTP over explicit TLS) if your client supports it, or keep the account's permissions as narrow as possible.
Creating a Scoped FTP Account in cPanel
Don't reuse the main account's FTP login for anyone but yourself. Every person or integration that needs file access should get its own account, scoped to only the folder it needs.
- Log in to cPanel and open FTP Accounts under the Files section.
- Under Add FTP Account, pick a username (this becomes
username@yourdomain.com). - Set a strong, unique password — cPanel's password generator is fine here, since the person receiving it will paste it straight into their FTP client anyway.
- In the Directory field, don't leave it at the account root. Type the exact subfolder, e.g.
public_html/client-uploads. cPanel will create it if it doesn't already exist. - Set a Quota — even a generous one like 5GB stops a runaway upload script or a compromised client machine from filling your entire disk.
- Click Create FTP Account.
Because the directory is set at creation time, the account is chrooted to that folder automatically — it can't cd .. out of it, can't see your other domains, and can't touch wp-config.php or anyone else's files on the same server.
Checking (and Fixing) the Jail
Occasionally an account created years ago, or migrated from another host, ends up with the wrong root. You can confirm the jail is actually working by logging in with the FTP client and trying to navigate upward:
ftp yourdomain.com
Name: clientuser@yourdomain.com
Password: ********
ftp> cd ..
550 Permission denied.If that cd .. succeeds instead of failing, go back into FTP Accounts in cPanel, find the account under Special Accounts, click Change Quota or delete and recreate it with the directory field set correctly. Don't just tell people to avoid going up a folder — enforce it at the account level.
Locking Down Access Further
A scoped directory is the baseline. A few extra steps make a real difference if that FTP password ever leaks:
| Setting | Where | Why it matters |
|---|---|---|
| IP restriction | cPanel → FTP Accounts → account settings, or an .htaccess deny rule on the FTP-served folder | Blocks logins from anywhere except the office or the agency's known IP range |
| Disable directory listing | Add Options -Indexes in an .htaccess inside the FTP folder | Stops anyone from browsing the folder's contents over plain HTTP if it's inside public_html |
| Separate accounts per person | FTP Accounts, one per user | Lets you revoke a single person's access without resetting a shared password for everyone |
| Passive port range | WHM → Tweak Settings (server admin only) | Narrows the firewall hole needed for FTP data connections |
If the account is only ever used by an automated deployment script, skip FTP entirely and use SFTP with a key pair instead of a password — no credential to phish, and you can revoke access by deleting one key.
Cleaning Up Old Accounts
This is the part everyone skips. Go back into FTP Accounts right now and look at the list. If you see accounts for a freelancer who finished a project eighteen months ago, or a temporary account someone created for a one-time upload, delete them. An unused FTP account with a weak or reused password is a standing invitation — it doesn't need to be exploited quickly to be a problem, it just needs to sit there until someone finds it. A five-minute audit every quarter is cheaper than a cleanup after a breach.
Frequently Asked Questions
Can I use the same FTP account for multiple people?
You can, but don't. If three people share one login and something goes wrong — a deleted file, a malware upload — you have no way to tell which of them did it. Individual accounts cost nothing extra and give you an actual audit trail.
Why does my FTP client show different folders than File Manager?
File Manager in cPanel logs in as the full account and starts at the account root. An FTP sub-account only ever sees the directory it was chrooted to at creation. That's expected behavior, not a bug.
Is SFTP the same as FTPS?
No. SFTP runs over SSH on port 22. FTPS is regular FTP wrapped in TLS, usually on port 21 or 990. They use different underlying protocols and different client settings, even though both encrypt the connection. If your hosting plan has SSH enabled, prefer SFTP — it's simpler to firewall since it's a single port.
My FTP account can upload but every file shows 403 when I visit it in the browser?
That's usually a permissions or ownership mismatch, not an FTP problem. Files uploaded via FTP should land with standard 644 permissions for files and 755 for folders. If they're coming in as 600 or with the wrong group ownership, check the client's default upload permissions setting.
Do I need a separate FTP account for each addon domain?
Not necessarily. One FTP account can be scoped to any folder under the main account, including an addon domain's document root. Create it the same way, just point the Directory field at that addon domain's folder instead of public_html.
