FTP moves files between your computer and the server using a desktop client. It is the right tool for volume: a whole site, a synced folder, thousands of files: mainly because it resumes interrupted transfers, which File Manager does not.
Use an encrypted connection
Plain FTP sends your username and password in readable form. Anyone positioned on the network can take them, and those credentials often reach more than the file area.
Configure the client for one of these instead:
FTPS host: yourdomain.com port 21 encryption: explicit TLS SFTP host: yourdomain.com port 22
Most clients default to plain FTP, so this is a setting you change deliberately. If a client warns that a connection is insecure, it is telling you something true.
The settings
Take them from cPanel rather than guessing: Email Accounts style guesswork does not apply here, and the FTP Accounts screen shows the exact values.
Username is the full string, [email protected], for accounts created in cPanel. Entering only the part before the @ rejects a correct password, and it is the most common failure across every client.
Your main cPanel username and password also work as an FTP login, and that account reaches your entire home directory. Use it yourself; do not give it to anyone else.
If the domain does not point here yet, connect to the server hostname from your welcome email instead. It works regardless of DNS.
Give contractors a scoped account
Create a separate FTP account limited to one directory rather than sharing your main login. The account cannot move above the directory you set, so someone working on one site cannot reach the others, the mail directory or your backups.
One account per person, deleted when they finish. With a shared login, removing one person means changing a password five people use, so it gets postponed indefinitely.
Managing FTP accounts in cPanel goes over creating and scoping them.
First connection problems
Login incorrect with the right password. The username is not the full address.
Connects, then hangs listing files. Passive mode. Switching between passive and active in the client settings resolves nearly all of these. It is a firewall behaviour instead of a credential problem.
Certificate warning on first connect. Expected. Accept it once for a hostname you recognise.
Uploads land somewhere unexpected. The account's home directory is not what you assumed. Check its configured directory.
Uploaded files do not appear on the site. They went above public_html, which is not served.
When File Manager is better
For a single edit, opening File Manager is faster than launching a client and connecting.
It also extracts archives on the server, which is by far the quickest way to deploy a site: upload one ZIP, extract, delete the archive. FTP cannot do that; it would have to send every file individually.
Most people end up using both, which is the right outcome. Uploading your website files goes into the archive route.
SFTP and FTPS are not the same thing
Both are encrypted and they work completely differently, which matters when one of them will not connect.
SFTP runs over SSH, on the SSH port. If your host has given you SSH access, you have SFTP, and it needs no separate configuration.
FTPS is ordinary FTP with TLS added, on the FTP ports. It is a different protocol despite the similar name.
Choose SFTP when SSH is available. It uses one connection rather than several, which is why it works through restrictive firewalls that break FTPS, and it can use a key instead of a password.
Active and passive mode
The setting behind most "connects but shows an empty directory" reports.
In passive mode your client opens both connections. In active mode the server opens one back to you, which almost never works from behind a home router or a corporate firewall.
Use passive. It is the default in most clients and it is the first thing to check when the login succeeds and the file list never arrives.
Uploading a site properly
For more than a handful of files, do not upload them individually. Compress the site into one archive, upload that, and extract it on the server.
It is dramatically faster, and it avoids the transfers that silently drop one or two files: producing a site that is almost working, with a fault that is very hard to find.
Then check where things landed. If the archive contained a folder instead of the files themselves, everything is now one level too deep and the site shows a directory listing instead of a homepage. How to Upload Your Website Files Using File Manager walks through the layout.
Resuming, and what breaks it
FTP resumes an interrupted transfer, which is its main advantage over a browser upload for large files.
Two things stop it working. Transferring in ASCII mode rather than binary corrupts anything that is not plain text, images, archives, PDFs, so set the client to binary or automatic. And a connection that times out mid-file can leave a partial upload that looks complete in the listing; compare the file size against the original before assuming it arrived.
Permissions after upload
Files should be 644 and directories 755, which is what a normal transfer produces.
If something fails with a permissions error, the cause is usually ownership instead of the numbers, and setting 777 to make it work converts an inconvenience into an exposure, because the file becomes writable by anyone on the server. Understanding File Permissions and Ownership deals with reading them.
Remove accounts you stopped using
FTP accounts accumulate. One created for a contractor two years ago is a working credential nobody is watching, and it is scoped to a directory that may now hold something else.
Review the list twice a year and delete anything you cannot account for. If unsure, disable it and see what breaks. Anything still needed announces itself within a day.