How to give someone file access without sharing your main login

A separate transfer account helps you give a developer or colleague access to the files they need and remove that access later. Confirm which transfer protocols and account types your hosting plan supports before creating a user.

The Control Center's Email creation form makes mail-only accounts. For a transfer account, use Control panel access → Hosting login to open Virtualmin and follow the steps below. Do not create a mailbox expecting it to provide SFTP or FTP access.

Create an account when the option is available #

1. Select the correct domain in Virtualmin.
2. Open Edit Users, then Add FTP user if your account offers it.
3. Choose an identifiable username and a unique generated password.
4. Set the home directory to the intended working area. For someone maintaining only an uploads folder, avoid selecting the whole website.
5. Review any mailbox, shell, database, or other permissions on the form and grant only what the task requires.
6. Save the account and provide the connection details through a private channel.

Setting a user's home directory does not, by itself, prove that the service prevents access outside it. The host must configure the appropriate restrictions. Ask support to confirm the boundary and whether the account supports FTPS, SFTP, or both. Virtualmin FTP account guide

Test the access boundary #

Connect using the new account. Upload and remove a harmless test file in the assigned folder. Confirm that the user cannot browse or alter unrelated sites or account configuration. If the access extends too far, stop using the account and ask support to correct it.

Test the application after an upload as well. Files can have the right visible permission numbers but the wrong owner or group, which can stop updates or PHP execution. Ask support for the expected settings for this hosting environment instead of applying a recursive permission change. Virtualmin website troubleshooting

Remove access when the work ends #

Disable the account when that option is available, review its files, then delete it only after checking the deletion summary. User deletion may also affect stored data or mail. Remove saved credentials from shared devices and rotate any main account password that you previously shared.

If the creation menu is absent, request a limited account from support. Do not hand out your main control panel login as a substitute.

Related: connect with encrypted transfer.