Confirm the actual transfer method first
Choose the encrypted transfer protocol your service supports and confirm the account's effective directory boundary before sharing it.
DirectAdmin FTP accounts and SFTP access may be managed through different service controls. SFTP runs over SSH and is not the same protocol as FTP with TLS (FTPS). Do not assume an “FTP account” automatically works for SFTP or that a hosting plan includes SSH. Ask the host or inspect the account’s enabled features for the supported protocol, hostname, port and authentication method.
This guide is for transferring website files into a known directory. First locate the domain’s effective document root; selecting the wrong directory can expose private files or leave changes invisible. Use an individual transfer account for each person or integration so access can be revoked without changing the hosting login.
Create only the access needed
Where FTP account management is available in DirectAdmin, create a new unique account with a strong password and set its directory to the specific site or upload path needed. Use the narrowest directory scope offered by the panel. If the panel only allows the account’s entire home directory, ask whether the host can provide a narrower supported option before issuing the credential. For SFTP, follow the host’s documented account and authentication workflow; its SFTP service may use an SSH account or an optional server module. Do not assume the FTP login works over SFTP without confirmation.
Record the permitted protocol and server name from the host’s instructions. For FTPS, verify TLS is enabled and that the client validates the server certificate. For SFTP, verify the server host key through a trusted host-provided channel on first connection. Avoid plain FTP for credentials and files. Do not disable certificate or host-key verification to get a connection through.
Test the directory boundary
Connect with a client configured for the confirmed protocol and account. Upload a harmless unique text file into the intended directory, request it through the intended website if it is public content, then delete it. If the upload succeeds but the page stays unchanged, check the effective document root, cache and deploy process before widening permissions. For a promised directory scope, use only an owner-approved denied-path check within the same customer account, or ask the host to confirm the restriction. Do not try to access another customer’s files.
A login failure can mean the wrong protocol, port, full username, password or an account that has not been enabled. A TLS or host-key warning needs verification with the host, not a “trust anyway” click. A permission-denied upload may reflect directory ownership or a deliberately read-only path; ask the host for the correct upload route instead of recursively granting broad write permissions.
For example, transfer a harmless file into the assigned folder and test denial only at an owner-approved path in the same customer account. Do not probe another customer’s files. If the client cannot show the boundary reliably, ask the host to confirm the server-side restriction before sharing the account.
Remove access when the task ends
Keep transfer credentials in a password manager or approved secret store. Do not paste them into a ticket, script repository or shared chat. Revoke a temporary user once transfer and verification finish; rotate the account password if it was exposed. Confirm the deployed site still serves and that other authorised users retain their access. If the host does not offer the required encrypted, scoped method, ask for an alternative deployment workflow rather than enabling insecure transfer.
Common questions
Is FTPS the same as SFTP? No. They use different protocols and account configuration.
Can every DirectAdmin user create SSH keys? Availability is host-dependent.
Should I put backups in public_html? No. Keep private archives outside any served document root.
Sources and technical references
Related guides
Was this guide helpful?
If you accepted optional analytics, your Yes/No answer and this guide’s page address are sent to Google Analytics. No written feedback is collected. Read our privacy statement or change your choice in .
Need help with your service?
Open your client area or contact Novasean. Describe the symptom and checks you have performed. Keep passwords, recovery codes and private keys out of your message.