I am new here, but I am experiencing something that seems to be quite unique. I did research online and could not find an answer to this. So I created this post to see if I can get some clarity.

As part of my security procedures, I check my hosting provider(BLuehost) accounts to make sure no new unauthorized FTP accounts are being created. Recently I checked and I noticed that 11 new FTP accounts were created without authorization. Since I work with a contractor to support my site I asked him if he created the accounts and this is the response I got.

Response from ontractor:

Response from Contractor

Is that something that anyone has ever come across? Is this normal? or is this a security concern?

Here is a screenshot of the unauthorized accounts created:

FTP Accounts created:

The Unauth FTP accounts created

Any information is greatly appreciated.

Additional Info:
Website: Created using Wordpress
Hosting: Blue Host shared Hosting

  • 1
    If the 'apps' that are installing with one are adding a sub-domain or addon domain, then yes, creating an FTP account would be common since each app will have its own user account attached since those will have access to FTP, but not the dashboard. If you better security, use proper reseller hosting that contains jailed instances. Commented Sep 12, 2018 at 20:31
  • Thank you so much @SimonHayter. Just to confirm. The FTP accounts got created automatically, All the contractor did was to open and immediately close the "One Click Install" icon that shows on the cPanel of the hosting company (Bluehost), and the FTPs appeared right after that, but he did not install anything, is that still a normal or at least possible scenario? Thanks so much again for your help clarifying this. :)
    – Rick
    Commented Sep 13, 2018 at 0:15
  • I had the same concern. I think it is related to WP new user registration. with every new WP account system creates new FTP user
    – vova
    Commented May 1, 2022 at 18:24


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.