How to Restrict an FTP Account to a Specific Directory

If you need to give a developer, designer, or contractor FTP access to your website, you don't have to hand over access to your whole hosting account. You can create an FTP account that's locked to a single directory, so the user can only see and edit files inside that folder and its subfolders, not anything else on your hosting account.

Why Restrict FTP Access to One Directory

An FTP account with full access to your home directory can read, upload, and delete files anywhere on your hosting account, including other websites, email data, and backups if they're stored there. Restricting the account to one directory limits the damage if that FTP login is ever leaked, guessed, or misused, and it keeps a contractor's access scoped to only the project you hired them for.

Restricting Access When You Create a New FTP Account

The easiest way to restrict an FTP account is to set the restriction when you first create it.

In cPanel

1. Log in to cPanel and open FTP Accounts.
2. Fill in the Login, Password, and Directory fields.
3. In the Directory field, enter the specific folder you want this account limited to, for example public_html/client-project instead of leaving it at the default home directory.
4. Set a Quota if you want to also cap how much space this account can use.
5. Click Create FTP Account.

The account can now only log in to that folder and anything inside it. It cannot browse up to the parent directory or reach any other folder on your hosting account.

In DirectAdmin

1. Log in to DirectAdmin and open FTP Management.
2. Click Create FTP Account.
3. Choose Custom as the account type and enter the username and password.
4. In the path field, enter the specific folder you want this account restricted to, relative to your domain's document root.
5. Click Create.

As with cPanel, the account is then jailed to that folder and cannot access anything outside it.

Restricting an Existing FTP Account

Most control panels don't let you change the directory on an FTP account that already exists. The reliable way to move an existing account into a restricted directory is to recreate it.

1. Note the account's current login name (you'll reuse it) and make sure you know where its files currently live.
2. Delete the existing FTP account without deleting its files (both cPanel and DirectAdmin have a separate option or checkbox for this. Do not tick anything that says it will remove the account's files).
3. Create a new FTP account using the same login, with the Directory (cPanel) or path (DirectAdmin) set to the specific folder you want it restricted to.

Before sharing the new login with anyone, test it yourself first. Connect with an FTP client, confirm you land directly in the intended folder, and confirm you cannot navigate above it.

If you haven't created an FTP account before, see How to Create an FTP Account for the full account creation steps.