Understanding File Manager, FTP and Website Files

File Manager and file-transfer tools let you manage the files behind your website. Learn how to find the correct document root, protect your working copy and choose an appropriate transfer method.

Start here: locate the site before touching files

A hosting account is not necessarily one website. In cPanel Domains, identify the document root for the domain you intend to manage. Compare that directory with the site URL before uploading or deleting anything.

File Manager works through your authenticated hosting panel. FTP is a file-transfer protocol; plain FTP does not protect credentials in transit. FTPS adds TLS to FTP. SFTP uses SSH and is a different service, not an interchangeable FTP setting.

Choose a safe transfer method

Task	Useful option	Check first
A small, careful edit	cPanel File Manager	Correct domain and a downloaded original
Repeated bulk uploads	Provider-supported FTPS or SFTP	Exact host, protocol, port and account scope
Application migration	A reviewed migration procedure	Files, database, configuration and rollback

SFTP requires permitted SSH access. A restricted FTP account does not automatically have SSH/SFTP access. Use the provider’s documented connection details and verify the server identity rather than dismissing warnings.

Understand what belongs in the web root

• index.html or an application entry file supplies the landing page.
• CSS, JavaScript, images and fonts support its appearance and behavior.
• .htaccess can control Apache routing, redirects and access restrictions.
• Application configuration may contain database credentials and must not be exposed.

File Manager can hide dotfiles. Enable its hidden-file display when reviewing .htaccess, but do not modify unfamiliar provider files. Never place database exports, private keys, account backups, .env files or source-control history in a public directory.

Upload without losing the working copy

1. Download the affected original files to a private backup location.
2. Check the local build output and intended destination paths.
3. Upload a small, reviewed set or extract a verified archive into the correct isolated directory.
4. Avoid an extra enclosing folder that turns / into /dist/ or /site/.
5. Verify a page and its assets, then test internal links and forms.

Do not overwrite unknown files merely because a transfer client asks. Compare names, purpose and timestamps; use hashes for a controlled release. A CMS also needs its database and configuration, so copying files alone may not produce a working migration.

Permissions and troubleshooting

Use the host’s recommended ownership and permissions. A 403 may mean access rules, document-root configuration or permissions; a missing image can be a case-sensitive filename or wrong path. Making everything world-writable creates risk and rarely explains the real fault.

Eddie’s Field Notes

“Uploaded the whole project,” Eddie announced. “Including the secret configuration?” The reply was a very long silence. The lesson: publish the built public output, then verify the actual server inventory. A hidden file is not a protected file.

Recover carefully

If an upload fails, restore the backed-up affected files and verify the previous release. File Manager’s Trash may help with recoverable deletions, but it is not an independent backup. Never empty it until you understand what was removed.

Official references

• cPanel: File Manager
• cPanel: FTP Accounts
• cPanel: SFTP Client Configuration

Documentation checked 2026-10-18. Examples use reserved names and addresses; replace placeholders only for systems you are authorized to manage. Interfaces and included features depend on your provider and account.