🔍

Setting up FTP accounts in HostGator

File Transfer Protocol, usually shortened to FTP, provides a practical way to move website files between your computer and a HostGator server. It is useful when uploading a new site, replacing images, organising downloads, or giving a developer limited access without sharing your main hosting login. An FTP account connects a username and password to a particular directory inside your hosting space.

HostGator customers generally create these accounts through cPanel, then connect with an FTP program such as FileZilla, Cyberduck, or Transmit. The process is straightforward once the server name, port, folder path, and security settings are clear. A sensible setup also reduces the chance of someone accidentally changing files outside the area they need.

What an FTP account does

An FTP account is a separate set of credentials for transferring files. It normally includes a username, a password, and a home directory. The home directory controls what the user can see and edit. If you create an account for a contractor and point it to /public_html/client-site, that person should not need access to unrelated domains, email settings, databases, or billing information.

Your primary cPanel login is different from an additional FTP login. The cPanel account controls many hosting functions, including domains, email mailboxes, databases, backups, and security tools. An FTP user is narrower in scope. This separation is especially useful for Australian small businesses working with a freelance developer in Melbourne, a design studio in Brisbane, or a marketing agency in Perth.

FTP is a file-transfer method rather than a website management system. It cannot normally create a database, change DNS records, renew a domain, or configure WordPress. Use cPanel or the HostGator customer portal for those tasks. The portal is also the appropriate place to check invoices, support tickets, knowledge-base articles, and account notices.

Prepare the folder and access details

Before creating an account, identify the exact directory that the user needs. The main website commonly uses public_html, while an additional domain or subdomain may use a folder inside it. HostGator’s cPanel interface displays the directory structure, so inspect the folders before assigning access rather than guessing from the domain name.

A useful arrangement might look like this:

Keep each project in its own directory where possible. Giving a contractor access to the entire public_html folder may be convenient, but it also allows accidental changes to other sites hosted under the same account. A narrowly scoped directory is easier to audit and safer to remove later.

The folder name does not make a file private. Anything inside a publicly accessible web directory may be reachable through a browser if its address is known. For sensitive documents, use a protected area, a proper application login, or private storage rather than relying on an obscure folder name. A site publishing entertainment content, such as a page about five-reel games, should keep editorial files separate from private administration documents.

Create the account in cPanel

Sign in to the HostGator customer area and open cPanel using the account access link. In cPanel, locate the Files section and select FTP Accounts. The exact layout can vary slightly between HostGator plans and interface versions, but the account creation form normally asks for a username, domain, password, and directory.

Choose the domain associated with the files. Then enter a short, recognisable username, such as designer, backupuser, or shop-upload. HostGator may combine the chosen name with the cPanel username, producing a complete login such as accountname_designer. Record the full username shown by cPanel, because entering only the shorter label in the FTP application may fail.

Set a strong, unique password. A password manager is preferable to reusing the password for cPanel, email, or a domain registrar. If another person needs access, send the credentials through a secure password-sharing method rather than placing them in an ordinary email. If your team keeps recovery details in a physical or digital safe, review how those records are handled using secure storage guidance before storing hosting passwords there.

The directory field deserves particular attention. Enter the path that the user should treat as their root folder. A user restricted to /public_html/client-project should not be able to browse upwards into other website folders. If the directory does not yet exist, create it first with cPanel’s File Manager, then return to FTP Accounts and select the correct path.

Connect with an FTP client

After the account is created, open an FTP client and create a new connection. The usual details are:

Use the server hostname supplied in your HostGator account rather than assuming the website domain is correct. A domain may point to a different server during development, or its DNS records may still be updating. When a domain has recently been registered or transferred, DNS changes can take time to settle across Australian networks, including NBN connections in regional areas.

For security, select FTP over TLS, sometimes shown as Explicit FTPS, when the client offers it and the hosting account supports it. Standard FTP sends credentials without adequate encryption and should not be used for sensitive access on public Wi-Fi. An airport, hotel, or café network in Sydney is not an appropriate place to transmit an unencrypted hosting password.

Some hosting environments support SFTP, which is a different protocol running through SSH, commonly on port 22. Do not enter SFTP settings into an ordinary FTP connection and expect them to work. HostGator plan features can differ, so check the account documentation or support channel to confirm whether SSH and SFTP are enabled for your plan.

Upload and manage website files

Once connected, the FTP client usually shows local files on one side and server files on the other. Open the assigned remote directory before uploading. A website’s homepage is often called index.html or index.php, and it must be placed in the correct web root for the domain. Uploading it one level too high or too low can produce a directory listing, a blank page, or a server error.

Use clear file names and consistent folder structures. On Linux-based hosting, Logo.png, logo.png, and logo.PNG may be treated as different files. A page that works on a Windows computer can therefore show missing images after it is uploaded. Lowercase names without spaces, such as contact-form.php or hero-image.webp, help avoid broken links.

FTP clients commonly offer upload, download, rename, delete, and permission controls. Be cautious with drag-and-drop deletion: removing a live PHP file, configuration file, or rewrite file can take a site offline immediately. Keep a local copy of important files before replacing them, and make a backup through an appropriate HostGator tool or your site’s backup system.

File permissions may appear as numbers such as 644 for ordinary files and 755 for directories or executable scripts. Avoid setting everything to 777, which can expose files to unwanted modification. WordPress and other applications may need particular permissions, but changing them broadly is rarely the right fix for an upload problem. Check the application’s instructions or ask HostGator support before altering permissions.

Troubleshoot common connection problems

A failed connection does not always mean the FTP account was created incorrectly. First verify the full username, password, hostname, port, and encryption setting. Copying a password from a password manager can sometimes include an unwanted space. If the message says “authentication failed,” reset the FTP password in cPanel and test again rather than repeatedly guessing.

A connection that works but shows an empty directory often points to the wrong home folder. Return to cPanel’s FTP Accounts screen and check the directory assigned to that user. In the client, confirm that you are looking at the remote panel rather than the local computer. The user may also have connected successfully but been restricted to a directory that contains no files yet.

Timeouts and connection refusals can relate to a firewall, an incorrect port, or passive-mode settings. Try passive mode, allow the FTP program through the computer’s firewall, and test from a trusted connection. If you are travelling between Adelaide and the Gold Coast, switching networks can change how a firewall treats the connection, so record which setting worked rather than changing several options at once.

For a live website, test the result in a browser after uploading. Check the homepage, images, CSS, forms, and any server-side features. If a site is being developed under a temporary URL, remember that links and redirects may still refer to the final domain. HostGator’s knowledge base, video tutorials, forums, and ticket support can help when the error involves server restrictions rather than local FTP settings.

Keep FTP access secure over time

Review FTP accounts regularly and delete accounts that are no longer needed. Temporary access for a photographer, developer, or migration project should have a defined end date. If a staff member leaves or a supplier changes, remove their FTP account promptly and rotate credentials that may have been shared.

Use separate accounts for separate roles. A developer who edits one landing page does not need the same access as the person maintaining every domain. Limiting permissions reduces the impact of a stolen password and makes activity easier to understand when several people work on one hosting account.

Avoid saving credentials in an unprotected text file, browser profile, or shared chat. Use a reputable password manager with multi-factor authentication, protect the cPanel account itself, and keep your computer’s operating system and FTP client updated. Scan uploaded files for malware when content comes from outside your organisation, particularly before placing scripts in a public web directory.

A practical maintenance routine is simple: check the account list monthly, remove unused users, review the assigned directories, and confirm that encrypted connections are still being used. Keep a current local backup before major changes, especially around busy periods such as an end-of-financial-year promotion or a Christmas trading update. These small checks prevent an old contractor login from becoming a permanent weakness.

After creating the account, connect with the full username, confirm the intended directory, upload one harmless test file, and open it through the correct website address before granting access to anyone else.