Anonymous FTP Access
Anonymous FTP allows a user to retrieve documents, files, programs, and other archived data from anywhere in the Internet without having to create a userid and password. With the special userid of “anonymous” the network user can bypass local security checks and have access to publicly accessible files on the remote system. You can allow anonymous FTP access to visitors wishing to download or upload files to your web site as if you were running your own FTP server.
Anonymous FTP grants all users the ability to access your upload directory, or any directory on your domain that has been set for “public” read/write permissions. Anonymous users can have access to upload or download files to and from your domain. So you must set the appropriate permissions for the directories on which you wish to restrict anonymous FTP access. You can restrict access to specific files and directories on UNIX servers using the File Manager by disabling public read and/or write access to the files or folders you don’t want people to see. This ensures that anonymous users will not be able to access the restricted files or directories.
What Is Anonymous FTP?
Anonymous FTP lets anyone connect to an FTP server with the username “anonymous” and no real password, usually to download public files. It was designed for software mirrors and public archives, and it still exists on many servers.
Why It Is Risky
- Anyone on the internet can browse and download whatever you expose.
- If uploads are allowed, attackers can store malware or illegal files on your server.
- FTP sends data and credentials without encryption.
- Abuse can use up your bandwidth and get your IP blocklisted.
When It Is Acceptable
Only when you intentionally publish public, read-only files, such as a software download mirror, and you accept that everyone can see them. For almost every other case, turn it off.
How to Enable or Disable It in cPanel/WHM
- Log in to WHM as root.
- Open FTP Server Configuration.
- Find the anonymous login setting and choose to allow or disallow it.
- Save, and restart the FTP service if asked.
In cPanel itself, the FTP Accounts area shows regular accounts. Anonymous access is a server-level setting controlled by the administrator.
If You Must Allow It: Safer Settings
- Make the anonymous area read-only and disable uploads.
- Keep it in a separate folder with only the files you intend to share.
- Limit connections and bandwidth.
- Monitor the FTP logs regularly.
Safer Alternatives
- SFTP over SSH encrypts everything and uses the same login as SSH.
- SSH keys remove password guessing from the picture.
- HTTPS downloads from a web directory suit public files better than FTP.
- Object storage or a CDN serve public files at scale.
Frequently Asked Questions
Is anonymous FTP enabled by default on cPanel?
Modern setups normally disable it. Check FTP Server Configuration in WHM to be sure.
How do I know if it is on?
Try connecting with the username anonymous from another machine, or check the FTP server settings.
What should I use instead of FTP?
SFTP or SSH-based transfers. On a VPS you can set up SFTP in minutes.
Pro Tips and Best Practices
Disable what you do not use
Turn off FTP entirely if you only use SFTP or SSH.
Enforce encryption
If you keep FTP, require TLS so credentials are not sent in clear text.
Restrict by IP
Limit FTP and SSH access to known IP ranges where possible.
Rotate credentials
Change FTP passwords regularly and remove accounts of former team members.
Scan uploads
Scan uploaded files for malware, especially if anyone can upload.
Audit regularly
Review FTP users and logs every month.
Related Guides and Next Steps
Explore more help in our hosting blog, compare our best VPS hosting plans, or contact our team if you would like help applying these steps on your server.
