Open the FTP accounts page in your hosting control panel, find out who each login belongs to, delete the ones nobody needs, change the main password, and switch the rest to encrypted connections.

The list in the control panel

Open the FTP accounts page in a hosting control panel and there is often a list: designer, dev2, photos, test, a first name or two, a plugin company's name.

Each is a username and password that can upload, change or delete the files that make up the website.

Most were created for a single job. The job finished and the login stayed, and nobody at the business now remembers who has it.

Who ends up with a login

The third is the one nobody thinks about. A vendor's support team changes over the years, and the login you sent them sits in a ticket system you will never see.

Why each one is a way in

An FTP login can change any file it reaches. That is enough to hide a script in the site, replace a page, or slip spam links into the footer.

The password usually lives on someone else's computer, saved in their file transfer program. If that computer picks up malware that steals saved passwords, your site goes with it.

And plain FTP sends the username and password unencrypted, readable by anyone watching the network, from a coffee shop's Wi-Fi to a compromised router.

Old logins are rarely changed, so a password leaked years ago may still work today.

Make the list first

Write down every login that can touch the site's files: each FTP account, the main hosting login, which on most shared hosting also works for FTP, and any SSH access the host provides.

Beside each, note who it belongs to, why it exists and which folder it reaches. Ask the host for the last login date if the control panel does not show it.

Any account nobody can explain is a candidate for deletion. Anyone who genuinely needs it will ask for access again, which is easy to give.

Repeat the exercise twice a year, and whenever a designer, developer or staff member stops working on the site.

Deleting without losing files

Deleting an FTP account removes the login. But many control panels offer to delete the account's folder at the same time, and that folder may hold part of the site.

Leave that option unticked unless you are certain the folder is empty or unused. A login is easy to recreate; a deleted gallery is not.

Then change the main hosting password, since any former designer probably had that too, and update it wherever the business keeps passwords.

Signs a login has been used

If the site has been acting oddly, look before deleting anything. Files with recent dates nobody can explain, unfamiliar scripts in the main folder, or a warning from the host are all reasons to ask questions.

Hosts keep logs of FTP logins. Ask for the last few months, note which accounts connected and from where, and keep the answer with your list.

A worked example

A tennis club with outdoor courts and a small clubhouse runs its website through a hosting account in the club's name. A volunteer on the board looks after it, and the volunteer changes every year or two.

This January the new volunteer opened the control panel and found nine FTP accounts.

Three were named after former volunteers. One belonged to a photographer who had once filled the old photo gallery, another to the developer of the court booking system.

There was also one called test, one from a company that cleaned up a hacked site in 2014, and two that nobody on the board could identify.

Eight were deleted, with their folders kept. The developer's account stays, limited to the booking system's folder, and the new volunteer has one of their own, both with new passwords and encrypted connections.

The list now sits in the board's handover notes for whoever takes over next year.

Encrypted connections only

Plain FTP dates from a time when nobody worried about who could see network traffic. FTPS, which adds encryption to FTP, and SFTP, which runs over a secure shell connection, both protect the password and the files.

Most hosts support at least one. File transfer programs offer them in the connection settings, and some hosts let you switch plain FTP off altogether.

Ask your host which it supports and whether plain FTP can be disabled. Switching is usually one setting in the program, and sometimes a different port.

One person, one login, one folder

Never share a login between people. When one of them leaves, a shared account means changing the password for everyone, which usually means nobody does.

Limit each account to the folder it needs. A photographer uploading to a gallery does not need access to the whole site.

For one-off jobs, create a temporary account and delete it when the invoice is paid. Put that step on the same list as paying it.

Where the passwords should live

FTP passwords tend to live in old emails, on sticky notes and in the memory of whoever set them up. None of those survive a change of staff.

Keep them in a password manager owned by the business, with each entry noting who holds the account and why. A login with no entry is one nobody is responsible for.

The counter-case

Some sites have no extra accounts at all: only the web company holds access, through the main login. The review is then a single question: who else has file access?

Some managed hosting offers no plain FTP, only encrypted access with a login per person, which makes the list short and the job quick.

Either way, someone should know exactly who can change the site's files, and the answer should be short.

The clear-out

  1. Open the FTP accounts page in the control panel.
  2. Write down who each login belongs to.
  3. Delete the ones with no current owner.
  4. Keep their folders when deleting.
  5. Change the main hosting password.
  6. Switch the rest to encrypted connections.
  7. Book the next review for August.

Step five closes the biggest door. Deleting extra accounts achieves little if a former designer still has the main login, which opens every file and the control panel itself.

While you are in the control panel, the PHP version deserves a look too, as covered in PHP 5.6 moves to security fixes only.

Frequently asked questions

Why are old FTP accounts a risk?

Each one can change the files that make up your site, and the passwords often sit on other people's computers, unchanged for years.

Where do I find the FTP accounts?

In your hosting control panel, usually on a page called FTP Accounts. Remember the main hosting login also works for FTP on most shared hosting.

Will deleting an FTP account delete files?

Not the account alone, but many control panels offer to delete its folder too. Leave that unticked unless you are sure the folder is unused.

What makes plain FTP unsafe?

It sends the username, password and files unencrypted, so anyone watching the network can read them. FTPS and SFTP encrypt the connection.

Should people share one FTP login?

No. Give each person their own account, limited to the folder they need, so one can be removed without changing everyone else's password.

How often should FTP accounts be reviewed?

Twice a year, and whenever a designer, developer or staff member stops working on the site. Delete temporary accounts as soon as the job is paid.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Logins in your control panel nobody recognises?

Ask us to review them. We will identify each one, remove the dead ones and set up encrypted access.

Start a Conversation