Files and FTP Access

Every account owns a home directory, and everything it serves lives inside it. Knowing the layout answers most “where do I upload this?” questions without opening the panel.

The home directory

/home/example/
├── public_html/                    ← example.com  (the primary domain)
│   └── index.php
├── domains/
│   ├── blog.example.com/           ← a subdomain
│   └── otherproject.com/           ← an addon domain
└── …                               other files, not served by the web server

Path	Serves
~/public_html	The primary domain, and every alias of it
~/domains/<domain>	An addon domain
~/domains/<fqdn>	A subdomain, for example ~/domains/blog.example.com

domains/ sits next to public_html, not inside it. That is deliberate: a site placed inside the primary’s document root would be served twice — once under its own name and again as https://example.com/<name>/, that second time with the primary’s settings (its web mode, its WAF exceptions, its maintenance state), and search engines would index the duplicate. Keeping each site in its own directory means each one is reachable only under its own domain.

Anything outside public_html and domains is not reachable over the web — which is where application code, configuration and data that must not be downloadable belong.

Files are owned by the account’s Linux user. PHP runs as that same user, so a file the account can read, its site can read — and no other account can.

FTP access

Each account gets one FTP account, created with the account itself:

Server	Your server’s hostname or IP
Username	The account’s system username
Password	Set when the account was created — independent from the account password
Encryption	Explicit FTP over TLS (FTPS)
Home	The account’s home directory

The FTP server is Pure-FTPd, authenticating against CorePanel through the corepanel-auth broker, and each account is chrooted to its home directory: an FTP session cannot walk out of it.

Use FTPS, not plain FTP

Plain FTP sends the password and the files in clear text. Every modern client (FileZilla, WinSCP, Cyberduck, lftp) supports explicit TLS — select Require explicit FTP over TLS. The certificate is provisioned automatically for the connection.

Changing the FTP password

From the account workspace, Access → the FTP password field. Changing it does not change the panel password for the account, and vice versa: the two start identical when the account is created and are independent from then on.

Command-line access

An account’s Linux user is a normal system user, so on a server where you allow it you can also work over scp/rsync/SSH. That is a server-level decision — CorePanel does not manage SSH access for accounts, and does not enable it for them.

What CorePanel does not include (yet)

There is no file manager in the panel. Uploading, editing and moving files is done over FTPS, or over SSH if you have enabled it for the account. If you need to fix a single file quickly, an FTPS client with an editor (FileZilla’s View/Edit) is the supported route.