Manage cPanel FTP Accounts with Restricted Directories and Safe Deletion

cPanel FTP Accounts creates file-transfer credentials with a chosen top-level directory. That directory is a permission boundary for the FTP login, not an independent hosting account or an automatic SSH/SFTP entitlement.

Create narrowly scoped access

1. Enter verified HTTPS cPanel and open Files > FTP Accounts where enabled.
2. Choose the intended login/domain and generate a unique protected password.
3. Inspect Directory carefully. For a subdomain-only task, use that subdomain’s actual document root from domain settings; it is not always public_html/stock.
4. Set a deliberate supported quota and create the account. Record the exact full login name supplied by the panel.
5. Verify encrypted access and permitted scope using harmless test data before handing access to someone else.

The FTP top directory includes its descendants. Check that unrelated content is outside that tree; writable website code can still expose application secrets or affect a site. Do not use a broad main-account login to test whether a restricted login is confined.

Change password or quota

Select the exact account’s Change Password or Change Quota action, save and verify the intended result. Update authorized clients without sharing the secret publicly. Quota controls vary by daemon: cPanel documents virtual-user quotas for Pure-FTPd, not ProFTPD. Unlimited in this field does not override the hosting account’s storage or inode limits.

Delete the account without deleting the website

Preserve required files first. cPanel distinguishes Delete Account from Delete Account and Files. The second can remove the account’s entire home directory and contents, including public_html if that is its scope. Use account-only removal when retiring credentials without deleting content, and inspect confirmation before continuing.

Review active sessions separately; do not assume a credential change instantly closes every existing connection. Main/special accounts have different management restrictions. An old instruction to resynchronize passwords through an unspecified Admin Center is not a universal requirement.

Use the right encrypted protocol

Obtain actual FTPS settings and verify the service certificate. SFTP requires the appropriate SSH-enabled identity, not an arbitrary FTP virtual user. Preserve least privilege rather than granting shell access just to reuse a client setting.

References: cPanel directory, quota and deletion scope and SFTP account requirements.

Reviewed October 16, 2026. The matching restricted-folder FAQ was consolidated here. No credentials, directory permissions, session or customer files were changed or tested.