Set up an FTP account and know when not to use one

An FTP account gets files in and out of your site without a terminal. It is the quickest route for a first upload, and the slowest one for maintaining a site over time.

The number of accounts you can create is set by your plan. Launch allows one. The form tells you where you stand before you start typing, in a line that reads 0 of 1 FTP accounts used, or whatever your plan allows. On a paid tier that figure is higher, and the limit is worth knowing before you plan to give a developer their own login.

Creating the FTP account

Open Advanced, then FTP accounts.

The Add FTP account page. A line above the fields reads 0 of 1 FTP accounts used. Below it a Username field with the domain fixed beside it, a Password field beside a list of five rules reading one lowercase character, one uppercase character, one number, one special character and ten characters minimum, and a Directory field defaulting to a single slash.

The list is empty until you add one, and the empty state is not an error. Choose Add account.

Four fields.

The username has the domain fixed beside it, so you type only the part before the at sign. Choose something that names the purpose rather than a person. A shared account labelled deploy is easier to revoke than one named after whoever left.

The password field lists its own rules beside it. One lowercase character, one uppercase character, one number, one special character, ten characters minimum. A mixed case passphrase that happens to contain a number and a symbol satisfies all five, and it is easier to remember than a scramble.

Then there is the directory, which is the access scope and the field most people leave at the default and later wish they had set.

You can set it to any path in your account, and it is worth setting rather than accepting the default. / reaches your whole home directory, which holds the website but also the logs, redis.conf and the private directory. Point it at public_html and the account cannot see any of that. The server still confines the account to your home, so / is not a way out of your account, only a wider view of it.

Connecting

Any FTP client works. Fill in the host, the port, the username as shown in the panel with the domain attached, and the password you set.

The server is Pure-FTPd and it supports TLS, so choose explicit FTPS in your client if it offers the choice. That encrypts the session, password included. Without it the password crosses the network in the clear, which is a real exposure on a shared connection.

SFTP is a different door, not a setting on this one. It runs over SSH on port 22 and authenticates against your SSH account rather than this FTP username, so the details you set here will not work there. The article on creating an SSH key covers that route.

A dot file such as .htaccess is often hidden by default in these clients. There is usually a toggle for showing hidden files, and nothing is wrong when a file you know exists does not appear.

When FTP is the wrong tool

Two cases, and both are common.

A site you maintain over time is better served by SSH or by editing through the Files tab. FTP transfers whole files, so a single-line change means downloading, editing and re-uploading the whole thing, which is how a file gets overwritten with an older copy from the wrong folder.

Anything automated should not use an interactive FTP account at all. Deployment over SSH, or a git checkout, gives you a record of what changed and when. An FTP upload gives you no history and no way to tell which of two identical files is the newer one.

If you are out of accounts

Delete an account you no longer use rather than working around the limit. The same menu lists existing accounts and their delete controls. A login for a contractor who finished six months ago is exactly the kind of thing that stays active because removing it never became urgent.

Watch the checkbox when you delete

The delete dialog offers an option to delete the contents of the home directory as well as the account. Leave it alone. The two are separate operations and only the second destroys data.

How much that second option would take depends on the directory the account was given. An account scoped to public_html would remove the website. An account left on / reaches your whole home directory, so ticking the box on one of those would take the website, the logs and the configuration with it.

Deleting the account by itself does not touch the files it uploaded. It only removes the way in, which is what you want.