# Files and FTP Access > The layout of an account's home directory, which directory serves which domain, and how to connect over FTPS. Source: https://www.corepanel.net/docs/accounts/files/ Last updated: 2026-08-09 Part of the CorePanel documentation — https://www.corepanel.net/docs --- Every account owns a home directory, and everything it serves lives inside it. Knowing the layout answers most "where do I upload this?" questions without opening the panel. ## The home directory ``` /home/example/ ├── public_html/ ← example.com (the primary domain) │ └── index.php ├── domains/ │ ├── blog.example.com/ ← a subdomain │ └── otherproject.com/ ← an addon domain └── … other files, not served by the web server ``` | Path | Serves | |---|---| | `~/public_html` | The **primary domain**, and every **alias** of it | | `~/domains/` | An **addon domain** | | `~/domains/` | A **subdomain**, for example `~/domains/blog.example.com` | `domains/` sits **next to** `public_html`, not inside it. That is deliberate: a site placed inside the primary's document root would be served twice — once under its own name and again as `https://example.com//`, that second time with the *primary's* settings (its web mode, its WAF exceptions, its maintenance state), and search engines would index the duplicate. Keeping each site in its own directory means each one is reachable only under its own domain. Anything outside `public_html` and `domains` is not reachable over the web — which is where application code, configuration and data that must not be downloadable belong. Files are owned by the account's Linux user. PHP runs as that same user, so a file the account can read, its site can read — and no other account can. ## FTP access Every account is created with one FTP login — the **account credential**, named after the account's system user and reaching the whole home: | | | |---|---| | **Server** | Your server's hostname or IP | | **Username** | The account's system username | | **Password** | Set when the account was created — **independent from the account password** | | **Encryption** | Explicit FTP over TLS (**FTPS**) | | **Home** | The account's home directory | The FTP server is **Pure-FTPd**, authenticating against CorePanel through the `corepanel-auth` broker, and each session is **chrooted to the directory its account is confined to**: it cannot walk out of it. > **Use FTPS, not plain FTP** > > Plain FTP sends the password and the files in clear text. Every modern client (FileZilla, > WinSCP, Cyberduck, lftp) supports explicit TLS — select *Require explicit FTP over TLS*. > The certificate is provisioned automatically for the connection. ## Additional FTP accounts Beside that first login you can create more, each confined to a single directory. The usual reason is handing out access without handing out everything: a designer who should reach one site's `uploads` folder, a deployment script that should reach one docroot. Find them in the account workspace under **FTP accounts** — and a customer with the [client panel](https://www.corepanel.net/docs/client-panel/) manages their own under **Files & FTP**, with the same screen and the same rules. | Field | What to put in it | |---|---| | **Username** | The name, plus one of the account's own domains: `designer@example.com` | | **Directory** | Relative to the account home, e.g. `domains/example.com/uploads`. Created if it does not exist. Leave it empty for the whole home | | **Password** | Its own — it is a separate credential, not a copy of anything | The domain half of the name is not decoration. FTP authenticates by username alone, so logins are unique across the whole server; requiring a domain the account already owns is what stops one customer taking a name another account may need later. These accounts are **virtual** — no Linux user is created. They sign in with the hosting account's own uid and gid, which means they share its disk quota and can see exactly what that user can see. Confining one to a directory limits where its *session* starts and what it can walk into; it is not a new identity on the server. Deleting one removes the credential and **leaves its files alone** — the directory it pointed at stays exactly as it was. The account credential itself cannot be deleted: it is what the hosting account signs in with. How many you may create comes from the account's [hosting package](https://www.corepanel.net/docs/accounts/hosting-packages/) (*FTP accounts*, where `0` means unlimited), with a hard ceiling of 100 underneath it. The account credential is mandatory and counts against neither. ### Changing an FTP password In the **FTP accounts** section, use **Change password** on the row you mean — the account credential included. Changing it does not change the panel password for the account, and vice versa: the two start identical when the account is created and are independent from then on. From the command line, `corepanel ftp list` shows the ids and [`corepanel ftp`](https://www.corepanel.net/docs/cli/#ftp-accounts) creates, deletes and rotates them. ## Command-line access An account's Linux user is a normal system user, so on a server where you allow it you can also work over `scp`/`rsync`/SSH. That is a server-level decision — CorePanel does not manage SSH access for accounts, and does not enable it for them. ## What CorePanel does not include (yet) There is **no file manager in the panel**. Uploading, editing and moving files is done over FTPS, or over SSH if you have enabled it for the account. If you need to fix a single file quickly, an FTPS client with an editor (FileZilla's *View/Edit*) is the supported route.