Rotate an FTP password when access changes hands or an old credential may have been exposed. Each additional FTP user has its own password; the main system account may instead use the hosting account’s password.
IN THIS ARTICLE
01 Prepare for the change
Identify the full FTP username and its assigned directory. Check which deployment tools or automated jobs use the credential so you can update them after the change. Keep the replacement password in a password manager, not in a publicly accessible configuration file.
02 Change a separate FTP account password in cPanel
- Open FTP Accounts and locate the intended additional account. Choose its Change Password action.
- Enter and confirm a strong new password, or use the generator. Save the change for that specific account.
- Open a fresh encrypted FTP connection using the new password. An already-open connection is not a reliable test of new authentication.
- Update legitimate clients and deployment settings, then test a small authorised upload or directory listing.
- If the credential was compromised, inspect recent file changes and consider revoking the account rather than only rotating its password.
03 Confirm the expected result
Verify that the new credential works for the intended directory and that automated deployments have stopped retrying the old one. Check any saved FTP profile for an outdated username or host.
04 Example: change the credential used by an upload job
Identify the separate FTP account used by the job and record its allowed path. Rotate that credential without changing unrelated hosting or mailbox passwords.
Update the deployment tool's protected credential setting, then run a controlled transfer with a harmless file. Confirm the destination and ownership are correct before allowing the next production upload. Remove the test file when finished.
Why does the transfer still fail with the new password?
Check whether the tool has retained another saved credential, whether it uses the expected FTP username format, and whether the selected protocol and port match the service. A certificate, server-identity or path error should not be treated as proof the password is wrong.
Review other applications using the account so they do not continue retrying the old password. If you suspect the old credential was shared too widely, consider replacing it with individually scoped accounts rather than distributing the new password to the same broad group. Send us the redacted connection error, username and destination path when you need help, never the password itself.
What if the FTP identity has no separate password-change action?
If the target is a main/system FTP account without a separate password action, use the supported hosting-password change process. Do not change the cPanel password unnecessarily for an unrelated FTP user. A password reset does not reverse files an attacker may already have changed.