Files and FTP Access

Every account owns a home directory, and everything it serves lives inside it. Knowing the layout answers most “where do I upload this?” questions without opening the panel.

The home directory

/home/example/
├── public_html/                    ← example.com  (the primary domain)
│   └── index.php
├── domains/
│   ├── blog.example.com/           ← a subdomain
│   └── otherproject.com/           ← an addon domain
└── …                               other files, not served by the web server

Path	Serves
~/public_html	The primary domain, and every alias of it
~/domains/<domain>	An addon domain
~/domains/<fqdn>	A subdomain, for example ~/domains/blog.example.com

domains/ sits next to public_html, not inside it. That is deliberate: a site placed inside the primary’s document root would be served twice — once under its own name and again as https://example.com/<name>/, that second time with the primary’s settings (its web mode, its WAF exceptions, its maintenance state), and search engines would index the duplicate. Keeping each site in its own directory means each one is reachable only under its own domain.

Anything outside public_html and domains is not reachable over the web — which is where application code, configuration and data that must not be downloadable belong.

Files are owned by the account’s Linux user. PHP runs as that same user, so a file the account can read, its site can read — and no other account can.

FTP access

Every account is created with one FTP login — the account credential, named after the account’s system user and reaching the whole home:

Server	Your server’s hostname or IP
Username	The account’s system username
Password	Set when the account was created — independent from the account password
Encryption	Explicit FTP over TLS (FTPS)
Home	The account’s home directory

The FTP server is Pure-FTPd, authenticating against CorePanel through the corepanel-auth broker, and each session is chrooted to the directory its account is confined to: it cannot walk out of it.

Use FTPS, not plain FTP

Plain FTP sends the password and the files in clear text. Every modern client (FileZilla, WinSCP, Cyberduck, lftp) supports explicit TLS — select Require explicit FTP over TLS. The certificate is provisioned automatically for the connection.

Additional FTP accounts

Beside that first login you can create more, each confined to a single directory. The usual reason is handing out access without handing out everything: a designer who should reach one site’s uploads folder, a deployment script that should reach one docroot.

Find them in the account workspace under FTP accounts — and a customer with the client panel manages their own under Files & FTP, with the same screen and the same rules.

Field	What to put in it
Username	The name, plus one of the account’s own domains: designer@example.com
Directory	Relative to the account home, e.g. domains/example.com/uploads. Created if it does not exist. Leave it empty for the whole home
Password	Its own — it is a separate credential, not a copy of anything

The domain half of the name is not decoration. FTP authenticates by username alone, so logins are unique across the whole server; requiring a domain the account already owns is what stops one customer taking a name another account may need later.

These accounts are virtual — no Linux user is created. They sign in with the hosting account’s own uid and gid, which means they share its disk quota and can see exactly what that user can see. Confining one to a directory limits where its session starts and what it can walk into; it is not a new identity on the server.

Deleting one removes the credential and leaves its files alone — the directory it pointed at stays exactly as it was. The account credential itself cannot be deleted: it is what the hosting account signs in with.

How many you may create comes from the account’s hosting package (FTP accounts, where 0 means unlimited), with a hard ceiling of 100 underneath it. The account credential is mandatory and counts against neither.

Changing an FTP password

In the FTP accounts section, use Change password on the row you mean — the account credential included. Changing it does not change the panel password for the account, and vice versa: the two start identical when the account is created and are independent from then on.

From the command line, corepanel ftp list shows the ids and corepanel ftp creates, deletes and rotates them.

Command-line access

An account’s Linux user is a normal system user, so on a server where you allow it you can also work over scp/rsync/SSH. That is a server-level decision — CorePanel does not manage SSH access for accounts, and does not enable it for them.

What CorePanel does not include (yet)

There is no file manager in the panel. Uploading, editing and moving files is done over FTPS, or over SSH if you have enabled it for the account. If you need to fix a single file quickly, an FTPS client with an editor (FileZilla’s View/Edit) is the supported route.