FTP and SFTP

What this page is for: give someone a sign-in to one folder of a PHP or WordPress website, for an FTP program such as FileZilla, WinSCP or Cyberduck — over FTP with TLS, or over SFTP — and see on the same page who may sign in to the website over SSH.

Open the website and its SSH/FTP page. The FTP users card is at the top, How to connect under it, and the website's SSH users at the bottom. The FTP server itself is on Software → FTP server. The page shows only what is on, and is named for it (What is off is not shown).

You need

• The owner's login. A temporary login and the read-only demo cannot see or change FTP users. Tia, the panel's assistant, can read them and switch one off, but she never adds an FTP user, sets a password or switches one back on — who may sign in to your server is yours alone.
• To confirm it is you — the 6-digit code from your authenticator app, or your panel password when two-factor login is off — to add an FTP user, to give one a new password and to switch one back on. Switching one off and removing one never ask.
• The FTP server installed (below), and its ports open at your hosting provider.

The rule that does not move: an FTP user reaches the one folder it was given and nothing else, as the website's own account. Not another website, not the panel, not root. The panel keeps only a hash of its password and can never show it again.

Install the FTP server

Open Software, find FTP server and press Install. It installs ProFTPD from your server's own distribution (Ubuntu 26.04, Ubuntu 24.04 or Debian 13, on amd64 and arm64) and starts it with SixPanel's own settings. Until then nothing on the server listens for FTP at all.

It is set up so that:

• FTP always uses TLS (TLS 1.2 or 1.3) — for the password and for every file. A program that does not start TLS is refused before it can send the password. There is no anonymous FTP.
• SFTP works for the FTP users that have all of the website's files, with the same name and password, on its own port. A user locked into a folder signs in with FTP over TLS only (see What an FTP user can do). Port 22 stays your server's own SSH.
• Failed sign-ins are banned: five in ten minutes ban that address for an hour, on every FTP port — when fail2ban is on your server, as it is after a SixPanel install.
• It stays small: at most 256 MB of memory, at most 5 connections at a time for each FTP user (you can change it, from 1 to 20) and 40 in all. A connection that does nothing for 15 minutes is closed.
• It works under your distribution's AppArmor. Ubuntu 26.04 confines ProFTPD with an AppArmor profile of its own, which lets it read only the distribution's FTP folders. SixPanel adds exactly the files its settings name — the settings, the user file, the certificate and its key, the SSH host keys SFTP uses — read-only, to the distribution's place for a server's own additions, /etc/apparmor.d/local/proftpd, between two lines that mark them as SixPanel's, and loads the profile again in the mode it is in. Anything else you put in that file stays yours. Ubuntu 24.04 and Debian 13 have no such profile, and nothing is written there.

Software → FTP server shows whether it runs, its version, its ports and every website's FTP users, with Restart the FTP server and Ports and limits. Change a port only when another program needs it: every FTP program must then be told the new one, and your provider's firewall must let it in.

Open the ports at your hosting provider

FTP needs three more inbound rules at your provider, beside the ones on Firewall and ports — and only while the FTP server is installed:

These are the ports the panel starts with; the How to connect card always shows the ones in use. SixPanel opens these ports on this server's own firewall while the FTP server is installed, and closes them when it is removed — and moves them when you change a port or the passive range on Settings. They show on Server → Firewall → Port rules as Opened by the FTP server — follows the service, with no Remove button; to keep one closed anyway, add a deny rule for it (a deny wins). A port a rule of yours already opens to everybody gets no second rule, and your rule is left as it is. With the firewall off the rules are kept and apply the moment you turn it on. If one still ends up closed (your deny rule, or nftables refusing the rules), the install and the How to connect card say so. SixPanel cannot open ports at your provider — Linode, AWS, Hetzner, DigitalOcean, Oracle or Google Cloud each have their own page for it. A closed port looks the same as a server that is not there: the FTP program waits, then gives up.

Check that they are open. The Can FTP programs reach this server? card on the website's SSH/FTP page tries the FTP port, the SFTP port and one port of the passive range from the internet when you press Check reachability (AllsWeb tries this server's own address only). A port your provider's firewall closes reads Blocked by your server provider, with where to open it at the provider this server runs at. The passive port reads Open when it answers "refused": FTP listens on those ports only during a transfer, so at rest that is the right answer. AllsWeb tries 21, 2222 and 40000–40100 — with other ports set under Ports and limits, the card shows what the server itself knows. More: Check that the internet can reach a port.

Add an FTP user

On the website's SSH/FTP page press Add FTP user:

• Name — lowercase letters, digits, dots, hyphens and underscores. The sign-in name is the name followed by @ and the website's name: anna on the website blog signs in as anna@blog, so two websites can each have an anna.
• Folder — inside the website's files (its app/ folder). Leave it empty for all of them, or name a folder to keep this user in it: wp-content/uploads for someone who only sends pictures, wp-content/themes for a designer. Tick Make the folder if it does not exist yet to have it made, as the website's own account.
• Password — at least 10 characters, and not the sign-in name. Generate writes a strong one. Copy it before you press Add: it is shown on this screen only.

Up to 20 FTP users per website.

Connect with an FTP program

The How to connect card has everything, with Copy beside the server's address:

• Server — your server's own IP address, not a domain behind Cloudflare: Cloudflare carries web traffic only, never FTP.
• FTP with TLS — port 21. In FileZilla choose Require explicit FTP over TLS (in WinSCP: FTP, TLS/SSL Explicit encryption). Leave the transfer mode on passive, which every program uses by default.
• SFTP — port 2222, the same sign-in name and password, for a user with all of the website's files. In FileZilla choose SFTP as the protocol.

SFTP from a terminal works too:

sftp -P 2222 anna@[email protected]

The first time, the program shows you the server's identity and asks whether to trust it. Compare it with the card before you say yes:

• For FTP with TLS, the certificate. When the panel has a domain of its own with a valid certificate, the FTP server uses that certificate — the card names the domain, and your program may say the name differs from the address you connect to. Otherwise it uses one the server made for itself, and your program asks you once to trust it. Either way, the certificate fingerprint (SHA-256) on the card is the one to compare. The panel domain's certificate is read again by itself after every renewal.
• For SFTP, the host key. These are your server's own SSH keys, so an SFTP program that already knows the server knows it here too.

What an FTP user can do

Inside its folder: list, download, upload, rename, make folders and delete. It cannot see or reach anything above that folder.

• Files belong to the website. Whatever it sends is owned by the website's own account (site-<name>), readable by the web server and by nobody else — exactly as the panel's own deploys leave files. PHP and WordPress can read and change them as usual.
• An upload appears only when it is complete. A half-sent PHP file is never run by the website.
• No links. An FTP user cannot make a link that points outside its folder, and a folder that becomes a link — even a folder above it — stops that user's sign-in over FTP with TLS.
• A user locked into a folder uses FTP with TLS, not SFTP. An SFTP program would follow a link that the website's own code put in place of the folder, and reach past it — so SFTP is for the users that have all of the website's files, who reach nothing that way the website could not reach already. The Folder column says it beside each such user.
• Your deploys keep its files. A PHP or WordPress website's deploy writes the files it ships and removes only the files the previous deploy shipped. A file sent over FTP stays — unless your code ships a file at the same path, which then replaces it.

Give an FTP user only to someone you trust with this website. Whoever can put a file in a folder PHP runs from can run code as the website.

Change a password, a folder, or switch one off

Each FTP user's row has its own buttons:

• Change password — the new password works at once, and a session signed in with the old one is ended.
• Change folder — counts from the next sign-in; a session open now is ended.
• Switch off — it can no longer sign in and its open session is ended. The password and folder stay, so Switch on brings it back as it was.
• Disconnect — shown while it is connected now: its open sessions end at once (an upload in progress stops) and nothing else changes, so it can sign in again. To keep it out, Switch off instead.
• Remove — for good, its password with it. The files it sent stay where they are.

The State column says On, Off, or Cannot sign in with the reason: its folder is gone or became a link, it has no password, or the website is being moved. connected now shows when it has a session open.

Which websites have FTP

PHP websites and WordPress sites. Their files are one folder that is updated in place, so a file sent over FTP stays.

Not static websites, Node.js apps or Create-with-AI websites. Each of their deploys goes live as a new release, so a file sent over FTP would be replaced by the next deploy. Their page has no FTP part — it is their SSH page, with their SSH users: copy files with scp, rsync or an SFTP program over SSH with a key.

Not 6amMart projects. A 6amMart project's code is deployed from git, and a deploy refuses a checkout with changed files, so a file sent over FTP would stop the next deploy. Its SSH/FTP page has its SSH users: use SSH with a key to read files and logs, and git to change the code.

SSH users

The bottom of the page is the website's SSH access — the same card as on its Terminal page, described on Terminal and SSH: off until you turn it on, keys only, never a password. Give a key a Name when you add it — "Anna's laptop" — and the list shows that name instead of the note at the end of the key.

What is off is not shown

A website's page holds only the parts that are on:

• FTP users and How to connect — while the FTP server is installed and running, for a PHP website or a WordPress site. Not installed yet, or stopped on Software → FTP server: the page has no FTP part at all (install or start it there).
• SSH users — while this server takes SSH. Turn SSH off on Server → Terminal (Terminal and SSH) takes this part away for every website. A website's own SSH access being off is not that: this card is where you turn it on.

With one part on, the page and its menu entry read FTP or SSH; with both, SSH/FTP. With neither, the website's menu has no such entry, and an old link to it opens the website's Overview. A reseller's or a user's website has the FTP part only: the server's SSH is its owner's. The menu follows a change made on another page within a few seconds of opening the website again.

While a website is being moved

A website that is being moved to another server takes no FTP sign-in from the moment the move pauses it, and a session open then is ended — as for SSH. Its FTP users come back by themselves when a move ends without moving the website. FTP users are not sent to the other server: add them again there, behind your own password.

Remove the FTP server

Software → FTP server → Remove stops it, ends every open session and removes ProFTPD and its settings, its lines in /etc/apparmor.d/local/proftpd too; nothing listens on its ports any more. The FTP users are kept, switched off, so installing it again later does not open every way in by itself: switch on the ones you still want. When you choose to delete its data as well, the FTP users and their passwords are deleted too.

How to check it worked

• Software → FTP server says Running.
• From your own computer, sign in with the FTP program and the details on the card, and upload a small file. The website's Files page shows it, owned by the website.
• Try once without TLS (in FileZilla: Only use plain FTP). The server must refuse before it asks for a password.

If it went wrong

• The program waits, then times out — a port is closed at your provider. Check all three: 21, the passive range 40000–40100, and 2222.
• It signs in, then the folder list never comes — the passive range is closed at your provider, or a firewall between you and the server blocks it.
• "SSL/TLS required" — the program is set to plain FTP. Choose Require explicit FTP over TLS.
• "Login incorrect" — check the full sign-in name (anna@blog, not anna), then the row's State. After five wrong passwords in ten minutes your address is banned for an hour.
• The certificate does not match the card — do not connect. Something between you and the server is answering in its place.
• The FTP server stopped after an upgrade of the distribution (Ubuntu 24.04 to 26.04 brings the AppArmor profile) — SixPanel adds its lines when the panel starts and starts an FTP server that failed again; Restart the FTP server does the same at any time. An FTP server you stopped yourself stays stopped.

The software card on this page

The ProFTPD card, on the project's FTP page, and on the website's while its FTP part is on. It is the same card as on Software: its state, its version, a waiting update and, for the owner, Restart (asked first, and refused while another job runs). On Software opens its card there, with who else uses it. See Software, search and the system monitor.