Creating a restricted cPanel Web Disk account

Choose the smallest directory the user needs and decide whether files there are public through the website. A Web Disk permission controls WebDAV access; it does not automatically prevent public HTTP access to files beneath the document root.

1. Open Web Disk in cPanel and find Create an Additional Web Disk Account.
2. Enter a username, choose the domain where applicable, and set a strong unique password.
3. Review Directory carefully. Its path is relative to the hosting account home, and the automatically suggested folder may not be the one you intend.
4. Select Read-Only for viewing and downloading, or Read-Write only when editing is required. Create the account.
5. Use Configure Client Access to obtain the actual secure connection details and test the account from a supported WebDAV client.

The user should see only the intended directory and have the planned ability to read or write. Test with a harmless file rather than important production data.

Before creating Web Disk access, decide which files the person actually needs. A designer uploading images usually does not need access to application configuration, database backups or every website under the hosting account.

Select the narrow working directory and appropriate read/write permissions using the supported control. Use a separate credential rather than sharing your primary cPanel login. If the intended client or operating system requires an additional compatibility option, review its security implications before enabling it.

How do I verify the restriction?

Connect as the new Web Disk user, not as your administrator account. Confirm the expected files are visible and that a harmless test file can be created only if writing is intended. Attempt to navigate above the permitted directory and verify that access remains constrained. Remove the test file afterwards.

Record the owner and purpose of the access, and review it when the work ends. Web Disk access and website application logins are separate. Removing a WordPress user, for example, does not automatically prove a file-access credential has been retired. Tell us the client application, directory and error when requesting assistance, without sending its password.

No. Digest authentication on an unencrypted connection does not encrypt file contents. Use HTTPS WebDAV with a valid certificate to protect the transfer. If access is too broad, correct the directory and permissions before sharing credentials. Remove the additional account when its purpose ends.

• Connecting a computer to cPanel Web Disk
• Password-protecting a website folder with cPanel Directory Privacy
• Creating and downloading a full cPanel account backup
• Adding an SSH public key to a cPanel account

• cPanel documentation