Connecting to FTP securely

FTP lets you upload and download your website's files with an app such as FileZilla or WinSCP. Connections are encrypted with "explicit FTP over TLS": the app connects on port 21 and switches to encryption before it sends your password. The How to connect box at the top of Hosting → FTP accounts shows the exact host and whether plain, unencrypted FTP is refused.

Create an FTP account

1. Open Hosting → FTP accounts and open Create FTP account.
2. Enter a Username (letters, numbers, dots, underscores and hyphens, up to 32) and a Password of 8 to 72 characters. Usernames are unique on the server, so a common name may already be taken.
3. Under Directory access, choose:
   • Single Directory, then the Home directory: a domain's folder, its website folder, or a subdomain's. The account sees only that folder and what's inside it.
   • Multi-Domain Virtual Root, then tick each folder to include. Each one appears as its own folder when you connect.
4. Press Create FTP Account.

To change the password or folders later, press Manage next to the account, fill in New password (optional) or change the folders, and press Save. If an account shows Retry setup, its setup on the server didn't finish: press it, and ask your host if it keeps failing.

Connect with FileZilla

1. Open File → Site Manager and add a new site.
2. Set Protocol to FTP - File Transfer Protocol (not SFTP).
3. Enter the Host from the How to connect box, and port 21.
4. Set Encryption to Require explicit FTP over TLS.
5. Set Logon Type to Normal, and enter the FTP username and password.
6. Press Connect.

Connect with WinSCP

1. In the login window, set File protocol to FTP (not SFTP).
2. Set Encryption to TLS/SSL Explicit encryption.
3. Enter the Host name from the How to connect box, port 21, and the FTP username and password.
4. Press Login.

Trusting the certificate the first time

If the How to connect box says the server's certificate is self-signed, your app asks whether to trust it the first time you connect. This is expected: the connection is still encrypted, but no public authority vouches for the certificate.

• In FileZilla, tick Always trust this certificate in future sessions and press OK.
• In WinSCP, accept the certificate and let it remember it.

The app asks again only when the server's certificate changes. If that happens and you don't know why, check with your host before accepting.

Which host name to use

Use the host exactly as the How to connect box shows it. When the server has a trusted certificate, it's issued for that one name, so connecting by IP address or by your own domain makes the app warn that the certificate doesn't match. If the box says "This server's hostname or IP address", either works, and you trust the certificate once as above.

Passive mode and firewalls

The server uses passive mode: after you sign in, files and folder listings travel over a second connection on a port between 30000 and 31000. FileZilla and WinSCP use passive mode by default. If you can sign in but folder listings time out ("Failed to retrieve directory listing"), your own network is probably blocking those ports. Ask whoever runs it to allow outgoing connections to ports 21 and 30000 to 31000.

Common errors

• 530 after the username, with a message about encryption. The app is using plain FTP, which the server refuses. Set the encryption to explicit FTP over TLS as above.
• 530 Login incorrect. The username or password is wrong. Set a new password with Manage if you're unsure.
• 522, or an error about TLS session reuse, when listing or transferring. The server requires the file connection to reuse the encryption set up when you signed in, so nobody else can take it over. FileZilla, WinSCP, lftp and curl do this; some older apps and scripts don't. Switch to one of those.
• Can't connect on port 22 or 990. FTP accounts don't work with SFTP (port 22), and implicit FTPS (port 990) isn't offered. Use explicit FTP over TLS on port 21.