How do I get FTP or cPanel access to my site?

How do I give a developer their own account?

1. Open FTP Accounts in cPanel.
2. Enter a Log In name that identifies the person, and pick the Domain.
3. Use Password Generator for a strong password.
4. Set the Directory to the folder they need. The account can reach only that folder and the ones inside it.
5. Set a Quota, or leave it unlimited if they’ll upload large files.
6. Select Create FTP Account.
   • Expected result: the account appears in the FTP Accounts table.
7. Give them the password by phone or through a password manager, never by plain email.

An account made this way is an FTP account, not an SFTP one. cPanel’s SFTP guide says you can’t use an FTP account to connect over SFTP. Have the developer connect with FTP over TLS (often called FTPS or explicit TLS) if your host supports it, never plain FTP. If they need true SFTP, ask your host to set up an SFTP-only user for them.

Other hosts have their own screens, often called “SFTP users” or “SSH/SFTP access.” The idea is the same: one named account per person, with limits. If you don’t manage the hosting, ask the host or your web company to do this for you.

These steps follow cPanel’s FTP Accounts guide, for hosts that use cPanel and manage it yourself.

The short version

• You usually don’t need FTP or cPanel. Page edits, posts and photos are done inside WordPress.
• For a developer, ask your host for a separate SFTP account and delete it afterwards.

When the job is done, how do I remove it?

In cPanel, find the account in the FTP Accounts table and select Delete, then Delete Account. cPanel’s guide warns that the other choice, Delete Account and Files, also removes that folder’s files. If the account could reach your site’s main folder, that choice would break the website. Choose carefully.

Who actually needs this access?

FTP-level access is for people changing the site’s files: a developer fixing code, someone installing a custom theme, or a host moving the site. A staff member who updates text or adds news needs a WordPress login instead. See add or remove a person’s access.

Because file access can change or delete anything on the site, treat it like a key to the building, not a key to one room.

Why does this matter?

WordPress’s own hardening guide says to use SFTP encryption when your host provides it. Plain FTP sends your password and files unencrypted. The same guide recommends cutting down the ways an attacker could get in. Every extra account, especially a shared one that nobody remembers, is one more way in.

Keeping the main hosting login yourself also matters for ownership. If a developer holds the only password and moves on, you can be stuck.

What are the common mistakes and edge cases?

• The login worked last month and now doesn’t. Two likely causes are a password that was reset on the hosting side and never passed on, and access that’s limited to approved IP addresses. If the developer’s office or home internet address changed, the host has to allow the new one.
• The site breaks after file work. WordPress keeps its database login in a settings file. If someone changes database passwords without updating that file, the site can’t connect. Have a current backup before anyone touches files. See is my website backed up?
• Your host doesn’t use cPanel. Many managed hosts have their own panel. Search their help for “SFTP.”
• A plugin upload fails with a 403 error. That’s often a security rule on the server, not a reason to switch to FTP. Ask the host to check it.
• Someone asks for “the cPanel password” by email. Check who’s asking by calling a number you already know. Don’t send it.

What if this didn’t work?

• You don’t know who hosts the site: our answer on which logins your business should own helps you find out.
• Your host won’t create extra accounts: some hosts allow only one. Then change the password after the developer finishes, and turn on two-factor login on the hosting account. See turn on two-factor login.
• The developer needs database access too: that’s a separate account again. Ask the host.

How does E-3 handle this?

On sites E-3 hosts, ask us before a developer works on the files. Never send passwords by email.

E-3 hosting includes daily backups, so an earlier version can be restored if a mistake is made. To set this up, email support@e3help.me with the developer’s name, company and what they’re working on, or call 814-399-4655.

Related questions

• How do I add or remove a person’s access to edit our website?
• How do I share logins with staff and vendors safely?
• Can you move my website to your hosting?