Blog / security monday
Is FTP safe for your website files?
Plain FTP sends your site login as readable text. Here is why we move site owners to SFTP, and how to clean up old file transfer accounts in cPanel.
Every few weeks we clean up a site that gets reinfected days after the cleanup. The malware is gone, the plugins are current, the admin passwords were changed, and the attacker still walks back in. Usually they did not break anything the second time. They logged in with a file transfer password that still worked, and that password was often travelling over the network in the clear.
This is the file transfer side of security, and it gets skipped because it feels like plumbing. It is worth ten minutes.
FTP was never built to be private
FTP is older than the web. The protocol sends your username and password across the network as readable text, and that is the design rather than a setting you can tighten. RFC 2228, the document the IETF published to bolt security onto FTP, opens by saying FTP "uses usernames and passwords passed in cleartext to authenticate clients to servers" and warns that "passwords can be stolen through monitoring of local and wide-area networks."
In practice that means anyone on the path between your laptop and the server can read the login as it goes by. Coffee shop wifi, a hotel network, a cheap router in the office that nobody has updated in five years. They do not need to attack your site. They just need to be sitting there watching traffic, and then they have write access to every file you can touch.
The file contents travel the same way, so a staging copy of a database dump or a client contract in a folder is readable too.
SFTP is already on your account
SFTP is a different protocol that runs over SSH, normally on port 22, and it encrypts the whole session including the login. cPanel's own documentation on File Transfer Accounts describes SFTP as transferring "files over an encrypted connection", and on our cPanel hosting accounts it is available by default.
Switching is a dropdown in your file transfer client, not a project. Set the protocol to SFTP, the host to your domain, the port to 22, and use your cPanel username and password. If your client supports an SSH key instead of a password, use the key. Then delete the old FTP profile from the client so nobody opens it out of habit next month.
One thing to watch: FTPS and SFTP are not the same thing, though the names look alike. Both encrypt, so either beats plain FTP, but the settings are different and mixing them up is where people give up and switch back.
Old logins outlive the people who used them
A site that has been around a few years has collected logins. The developer who built it, the agency that did the redesign, the person who fixed the contact form once in 2021. Each one got their own account, and nobody ever removed any of them. We see accounts with names we cannot match to a human on most sites we audit.
Open File Transfer Accounts in cPanel (older versions label it FTP Accounts) and read the list. Delete any User account you cannot attach to a person and a reason. Worth knowing before you click: cPanel removes the login but leaves the files in that account's home directory alone, so you are not deleting anything from the site by cleaning up a login. The same logic applies to WordPress users and cPanel logins, which we went through in who still has access to your site.
Your file transfer client is a password file
Most clients offer to remember passwords, and most of them store those passwords on disk in a form that is obfuscated rather than properly encrypted. Malware that runs on a desktop knows exactly where those files live and reads them in one pass. That is a common and quiet route into a website: nothing in the server logs looks like an attack, because the login was legitimate.
If your client supports a master password, turn it on. If it does not, store nothing in it and paste credentials from a password manager instead. And if a machine that held those saved logins was ever infected, treat every password on it as public and change them, starting with the hosting account itself. Locking down your hosting account covers the rest of that checklist.
A short cleanup, done once
Write down every file transfer account on the site and delete the ones you cannot explain. Rotate the passwords on the ones that remain. Set every client profile to SFTP on port 22 and remove the plain FTP profiles. Do it once, and put a note in your calendar to re-read the account list next time someone new touches the site.
That is this week's Security Monday. If you are not sure which of your file transfer accounts are still needed, or an SFTP connection is refusing to come up, open a ticket with our support team and we will look at the account with you.