Ahosting Logo
Knowledge Base

How to Connect to Your Hosting Account via FTP

Three ways to connect, and only two of them are safePlain FTPFTPSSFTPCredentials on thewirereadable by anyone on thepathencryptedencryptedPort2121, with explicit TLS22Common rejection causen/awrong encryption modepassword auth disabled,use a keyUse itneveryesyes, preferredA valid password rejected on the first try is usually the encryption mode or the port, not the password.

FTP moves files between your computer and the server using a desktop client. It is the right tool for volume: a whole site, a synced folder, thousands of files: mainly because it resumes interrupted transfers, which File Manager does not.

Use an encrypted connection

Plain FTP sends your username and password in readable form. Anyone positioned on the network can take them, and those credentials often reach more than the file area.

Configure the client for one of these instead:

FTPS host: yourdomain.com port 21 encryption: explicit TLS
SFTP host: yourdomain.com port 22

Most clients default to plain FTP, so this is a setting you change deliberately. If a client warns that a connection is insecure, it is telling you something true.

The settings

Take them from cPanel rather than guessing: Email Accounts style guesswork does not apply here, and the FTP Accounts screen shows the exact values.

Username is the full string, [email protected], for accounts created in cPanel. Entering only the part before the @ rejects a correct password, and it is the most common failure across every client.

Your main cPanel username and password also work as an FTP login, and that account reaches your entire home directory. Use it yourself; do not give it to anyone else.

If the domain does not point here yet, connect to the server hostname from your welcome email instead. It works regardless of DNS.

Give contractors a scoped account

Create a separate FTP account limited to one directory rather than sharing your main login. The account cannot move above the directory you set, so someone working on one site cannot reach the others, the mail directory or your backups.

One account per person, deleted when they finish. With a shared login, removing one person means changing a password five people use, so it gets postponed indefinitely.

Managing FTP accounts in cPanel goes over creating and scoping them.

First connection problems

Login incorrect with the right password. The username is not the full address.

Connects, then hangs listing files. Passive mode. Switching between passive and active in the client settings resolves nearly all of these. It is a firewall behaviour instead of a credential problem.

Certificate warning on first connect. Expected. Accept it once for a hostname you recognise.

Uploads land somewhere unexpected. The account's home directory is not what you assumed. Check its configured directory.

Uploaded files do not appear on the site. They went above public_html, which is not served.

When File Manager is better

For a single edit, opening File Manager is faster than launching a client and connecting.

It also extracts archives on the server, which is by far the quickest way to deploy a site: upload one ZIP, extract, delete the archive. FTP cannot do that; it would have to send every file individually.

Most people end up using both, which is the right outcome. Uploading your website files goes into the archive route.

SFTP and FTPS are not the same thing

Both are encrypted and they work completely differently, which matters when one of them will not connect.

SFTP runs over SSH, on the SSH port. If your host has given you SSH access, you have SFTP, and it needs no separate configuration.

FTPS is ordinary FTP with TLS added, on the FTP ports. It is a different protocol despite the similar name.

Choose SFTP when SSH is available. It uses one connection rather than several, which is why it works through restrictive firewalls that break FTPS, and it can use a key instead of a password.

Active and passive mode

The setting behind most "connects but shows an empty directory" reports.

In passive mode your client opens both connections. In active mode the server opens one back to you, which almost never works from behind a home router or a corporate firewall.

Use passive. It is the default in most clients and it is the first thing to check when the login succeeds and the file list never arrives.

Uploading a site properly

For more than a handful of files, do not upload them individually. Compress the site into one archive, upload that, and extract it on the server.

It is dramatically faster, and it avoids the transfers that silently drop one or two files: producing a site that is almost working, with a fault that is very hard to find.

Then check where things landed. If the archive contained a folder instead of the files themselves, everything is now one level too deep and the site shows a directory listing instead of a homepage. How to Upload Your Website Files Using File Manager walks through the layout.

Resuming, and what breaks it

FTP resumes an interrupted transfer, which is its main advantage over a browser upload for large files.

Two things stop it working. Transferring in ASCII mode rather than binary corrupts anything that is not plain text, images, archives, PDFs, so set the client to binary or automatic. And a connection that times out mid-file can leave a partial upload that looks complete in the listing; compare the file size against the original before assuming it arrived.

Permissions after upload

Files should be 644 and directories 755, which is what a normal transfer produces.

If something fails with a permissions error, the cause is usually ownership instead of the numbers, and setting 777 to make it work converts an inconvenience into an exposure, because the file becomes writable by anyone on the server. Understanding File Permissions and Ownership deals with reading them.

Remove accounts you stopped using

FTP accounts accumulate. One created for a contractor two years ago is a working credential nobody is watching, and it is scoped to a directory that may now hold something else.

Review the list twice a year and delete anything you cannot account for. If unsure, disable it and see what breaks. Anything still needed announces itself within a day.