I have added an ftp user via Plesk. How could I limit the ftp user's permissions so that they can read and write files, but not modify/delete?
This is not supported natively in Plesk, but you can probably make a workaround if you have root access (assuming you are on Linux) or can contact your hosting provider for this trick.
Create another user (i.e. "protector") and transfer directory ownership to him
useradd protector chown protector dir/
Then change directory rights so that only file owner can remove files from there. In Linux it is done with "sticky bit" concept:
chmod u+t dir/
and let other Plesk users to make files in there
chmod g+w dir/
Now make protected files owned by this another user:
chown protector dir/file_x dir/file_y
and prohibit others to modify them
chmod go-w dir/file_x dir/file_y
There may be different solutions for the same goal. i.e. 1) you can put all your files in subfolder and restrict access to it for FTP users. It will be very similar to the recipe above, but maybe a little simpler. 2) as FTP users cannot leave their directory, you can probably change site structure so that all sensitive files would be in different folder and thus no need to protect files from FTP users