FTP access in ISPmanager 6 is implemented via ProFTPD. You can create separate FTP users for each site with access restricted to the required directory only.

Creating an FTP user

Main menu → FTP Users → Create.

Field	Description
Login	FTP username
Password	Password for connecting
Path	Access directory (chroot)
Quota	Disk space limit

Chroot guarantees that the user physically cannot leave the specified directory even with cd ../../ — ProFTPD replaces the filesystem root at the process level, rather than merely hiding upper directories in the client's interface.

Additional access parameters

Account type: regular user or read-only access
IP restriction: access allowed only from the specified addresses
Maximum number of simultaneous connections
Transfer speed limit (throttling) for a single user

FTP connection parameters

Parameter	Value
Host	Server IP or ftp.example.com
Port	21
Mode	Passive (PASV)
Protocol	FTP or FTPS (explicit)

⚠️ Regular FTP transmits data in plain text. Use FTPS (FTP over SSL) or SFTP (SSH File Transfer) for secure file transfer.

SFTP instead of FTP

SFTP works over SSH and requires no separate setup — if a user has SSH access, SFTP works automatically:

# FileZilla:
Protocol: SFTP
Host: your_IP
Port: 22
Login/password: system user

# Or an SSH key instead of a password

✅ SFTP is preferable to FTP: encryption, reliability, operation through a single port (22).

Bulk file transfer with rsync over SSH

For transferring large volumes of data, FTP loses on reliability: a dropped connection means starting the transfer over. rsync over SSH re-sends only the files that changed and can resume an interrupted sync — noticeably faster for repeated uploads of the same site.

# Sync a local folder with the server over SSH
rsync -avz --progress ./site/ user1@your_IP:/var/www/user1/data/www/example.com/www/

# Running it again will only re-send the changed files

Passive FTP mode (for the firewall)

# ISPmanager → Settings → FTP Server → Passive port range
# Example: 49152-65534
# Open these ports in UFW:
sudo ufw allow 49152:65534/tcp

Without an open passive port range, an FTP connection often "hangs" on the LIST command: control commands over port 21 go through fine, but the data channel on a random high port gets blocked by the firewall.

Common FTP connection errors

Message	What it means
`530 Login incorrect`	Wrong login or password, or the user is blocked in the panel
`425 Unable to build data connection`	The passive port range is not open on the firewall, or NAT is not forwarding it
`550 Permission denied`	The user has no write permission for the specified directory, or the quota is exceeded
File list is empty even though files exist on the server	Chroot points to the wrong directory — the user only sees the contents of their own root

FTP, FTPS, and SFTP compared

Criterion	FTP	FTPS	SFTP
Encryption	None	Yes (TLS)	Yes (SSH)
Port	21	21 (explicit) or 990 (implicit)	22
Needs a separate port range	Yes, for passive mode	Yes, for passive mode	No
Works through a single firewall port	No	No	Yes

When FTP is not the right fit

You transfer credentials or confidential client files — plain FTP sends the password in cleartext, a direct interception risk on a shared network
The server sits behind strict NAT or a cloud firewall with no way to open a wide port range — passive FTP/FTPS will not work reliably, while SFTP solves the same problem with a single port
You need scheduled file synchronization via a script — for automation, a passwordless SFTP key is more convenient than an FTP password sitting in a plaintext config
The client connects from a network with unpredictable NAT (mobile internet, some corporate VPNs) — the FTP passive port range often breaks unpredictably there, while SFTP works reliably through a single port

Verifying the result

After creating an FTP user, confirm that access is actually restricted to the intended directory rather than the panel user's entire filesystem.

# Connect and check the current directory
ftp ftp.example.com
> pwd
257 "/" is the current directory

# Trying to leave the chroot should fail
> cd /etc
550 /etc: No such file or directory

If cd /etc succeeds inside the FTP session, the chroot is misconfigured and the user can potentially see other sites' files. See also creating a website in ISPmanager 6 and firewall configuration for the passive port range.