Restricting FTP Access – How to Manage FTP Access in cPanel

Unrestricted FTP access is a common but avoidable security gap. Learn how to lock down FTP accounts on your cPanel server.

Why FTP Needs Special Attention

FTP accounts are often created for specific short-term purposes — a developer needing temporary access, a one-off file transfer — and then forgotten. Each dormant or overly broad FTP account represents an unnecessary risk sitting on your server indefinitely.

Core Restriction Strategies

• Limit each FTP account’s access to only the specific directory it needs, never full root file system access.
• Remove or disable FTP accounts as soon as they’re no longer needed.
• Restrict FTP login access by IP address wherever the user’s location is predictable.

How to Manage FTP Access in cPanel

1. Log in to cPanel and go to Files > FTP Accounts.
2. Review the full list of existing FTP accounts and remove any that are no longer in active use.
3. For each remaining account, confirm the “Directory” field restricts access to only the necessary folder, not the account’s full home directory.
4. Use strong, unique passwords for every FTP account, following the same standards as your cPanel login.

Restricting by IP in WHM

1. In WHM, navigate to Security Center > Host Access Control.
2. Add allowed IP addresses for the FTP service (ftpd) if your users connect from known, stable locations.
3. Set the default policy to deny unlisted IPs for FTP access.

Ongoing FTP Hygiene

• Audit FTP accounts quarterly alongside your broader password and access review.
• Document the purpose of each FTP account so it’s clear when it can be safely removed.
• Prefer more secure alternatives (see the next article) over plain FTP wherever possible.

Restricting FTP access to only what’s necessary, for only as long as necessary, closes a commonly overlooked but frequently exploited gap in server security.