Member Avatar for FeralReason

Not sure if this is the right place to post this. I've built a number of websites but have just now been asked to provide a password protected page that allows different customers FTP access to download files.

I feel dumb. Having never done anything like this before. Obviously I have to get an ftp account from the hosting provider (not me) but it would be great if someone could outline the dummies version (for me) for setting something like this up. Does this require multiple FTP accounts ? What could I expect from the host and what should I be providing ?

Thanx !

  • 3 Contributors
  • 3 Replies
  • 214 Views
  • 18 Hours Discussion Span
  • Latest Post Latest Post by pritaeas

Dani AI

Generated

First, clarify with the client whether they literally want FTP access or just a password-protected web page. As suggests, many people ask for "FTP" but actually mean a simple download page. Also confirm whether customers need upload rights, how many customers, expected file sizes, and whether each customer must be isolated (as asked). Those answers determine the simplest, safest setup.

If the client really wants file-transfer accounts: prefer SFTP or FTPS over plain FTP (FTP sends passwords in clear text). Most hosts let you create multiple FTP/SFTP accounts in cPanel/Plesk or will create them for you. Typical workflow:

  • create one account per customer (best for auditing/revocation) or a single shared account if privacy between customers is not required;
  • set each account's home directory to the customer's folder (chroot) and apply a quota;
  • enable SFTP/FTPS and test with a client like FileZilla;
  • troubleshoot with passive-mode settings and confirm required ports are open on the server firewall.

Example client command:

sftp alice@ftp.example.com

If a web download page is acceptable: use HTTPS and either a small app with per-user logins or web-server authentication. A simple Apache Basic Auth example (requires HTTPS):

AuthType Basic
AuthName "Customer Downloads"
AuthUserFile /full/path/.htpasswd
Require valid-user

Create users with htpasswd -c /full/path/.htpasswd alice. For more control and logging, build a tiny authenticated download portal or use cloud storage with expiring (pre-signed) URLs.

Operational tips: prefer separate accounts/folders for privacy and easier revocation; rotate passwords; enable access logging and backups; check host limits (some shared hosts restrict extra FTP accounts). If the host won't allow per-user accounts, consider an upgrade or move to S3/managed file hosting. Bring these questions to the client meeting so the final approach matches security, scale, and usability needs.

Recommended Answers

All 3 Replies

Member Avatar for timpogue

Now, do you just want certain people to be able get access to a folder where they can download files?

Member Avatar for FeralReason

At the moment I don't know. Just trying to prepare for a meeting with the client. So the options could be:
1) Different customers, with different logins, who will have access to the same folder, or
2) Different customers, with different logins, who will each have access to a folder specifically for them.
Info on either or both would help !

Member Avatar for pritaeas

have just now been asked to provide a password protected page that allows different customers FTP access to download files.

These two statements actually contradict each other. Do you want FTP access, or do you want a password protected webpage where they can download/upload files? I think the one requesting this may not know what FTP is. Before you answer him, let him make very clear what it is he wants. I have a feeling he wants the latter.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.