I have web hosting account with what seems to be a reputable and security-conscious hosting company (Siteground). I'm using 2-factor authentication to log in to my account with them, HTTPS for my site, and SSH to move files to and from the server. However, the account also has what appears to be unencrypted FTP access which can't be disabled. I assume they know what they're doing but it seems like this leaves an unnecessary security risk:

  • If I log in via FTP, my password could be compromised since someone could see it in plain text. I can just not use FTP, but it seems like it would be safer to just not allow the connection at all.
  • Someone could brute-force their way into my account my guessing password, and the 2FA or SSH keys used for other access to the account would be moot.

Like I said, the company seems to know what it's doing in other ways, so am I missing something?

  • 1
    Point 2 is moot anyway, because you can brute-force anything that takes credentials. I can even brute-force 2FA. Pointless? Absolutely. Still possible. Same goes for SSH, of course. Rate limiting is what it’s all about. – Daniel B Jun 19 '17 at 11:48
  • It looks like your hosting provider does not care about their server security. Disabling the FTP might not be the option since most users use FTP for transfer. However, they could just have disabled plain text and allow only FTPS. – Mukesh Jagani Jun 19 '17 at 13:26
  • 1
    We cannot answer why your host allows FTP. Only your host can answer that. The best we could give are opinions why we THINK your host still allows FTP, and questions that require an opinion answer are not a good fit for Super User. – music2myear Jun 19 '17 at 21:07

I agree with you. However FTP is still allowed on so many hosts because it is the only tool many folks use to transfer files. It's a business decision trade off for your hosting company. As Daniel mentioned, the most important thing is the rate limiting, the amount of attempts your hosts allows and the wait in between attempts. If there is a reasonable limit on those, your FTP is still reasonably secure.

I suggest you ask these questions to your host. Good luck!

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.