FTP, FTPS and SFTP: give a developer only the access needed

FTP, FTPS and SFTP are not identical. FTPS protects FTP with TLS; SFTP operates over SSH and depends on SSH access provided by the host. An FTP account is not automatically an SFTP account.

Set up limited access

1. Ask the provider which encrypted transfer methods and hostnames are supported.
2. If using a separate FTP account, choose the intended domain and restrict its directory to the project folder.
3. Use a unique password and an appropriate quota. Do not give a contractor the primary account merely to upload one asset.
4. Configure the client using the provider’s connection details and certificate-valid hostname.
5. Verify that access is limited to the intended location before sharing the account securely.

When work ends

Review active accounts and remove access that is no longer required. In FTP Accounts, distinguish removing the account from removing both the account and its files. The latter can destroy the website if the directory is broad.

Avoid unencrypted FTP and do not place credentials in email attachments or deployment scripts committed to Git. With SSH access, protect private keys and use a passphrase. A directory restriction is a practical boundary, but it does not replace careful permissions and an independent backup.