FTP and SFTP access

Create an FTP or SFTP user with its own home directory on TurboStack, connect with a client, and fix common login errors.

You can create dedicated FTP and Secure File Transfer Protocol (SFTP) users with their own home directory, separate from your main system user. This is most often used to connect an external system - for example an Enterprise Resource Planning (ERP) system - to a store, giving it access only to the files it needs (product images, stock exports, report PDFs).

Create an (S)FTP user

In the GUI

  1. Open the host and go to Applications. Expand the account, open its settings (the cogwheel), and select Add FTP user.

  2. Enter the user name and the home directory (keep it a subfolder, not the account's home), and enable Transport Layer Security (TLS) if your client needs it.

  3. Save, then Save & Publish.

In YAML

Add an ftp block under the system user - see The Source (YAML) view:

system_users:
  - username: prod
    vhosts:
      - server_name: www.example.com
        app_type: shopware
        php_version: "8.4"
        cert_type: letsencrypt
    ftp:
      - user: prod_ftp
        homedir: /var/www/prod/public_html/ftp

Choose FTP or SFTP

A host uses either FTP or SFTP for all users. To use SFTP, add this above system_users:

ftp_sftp: true

SFTP runs over port 222 through the existing FTP daemon and users, not the SSH service. Port 22 stays reserved for SSH. If your ERP needs another port, set it:

ftp_sftp_port: 2222

Plain FTP uses port 21.

Connect

Get the user name and password from the host's Credentials tab, then connect with a client such as FileZilla using the host name, the user, and the right port (21 for FTP, 222 - or your custom port - for SFTP).

Fix a "Login failed" error

  • Wrong credentials - even a stray space in the password causes a 530 login error.

  • Home directory does not exist - the path assigned to the user must exist on the server.

  • No TLS - TLS is required and enforced. Enable "Explicit FTP over TLS" in your client. Only disable it for a system that genuinely cannot do TLS (passwords would be sent in plain text).

  • IP blocked - your IP may be (temporarily) firewalled. Add it to the allow-list under the host's Security tab - see Security.

© 2026 Hosted Power — TurboStack