Imagine reading your password aloud in a crowded cafe, then being surprised when someone uses it. Plain FTP does exactly that, only with fewer chairs.

When you log in over plain FTP, the commands USER and PASS travel as readable text. Anyone who can capture the traffic, such as someone on the same shared Wi-Fi, can read them. This is called password sniffing, and it needs no clever hacking. A free tool and ten minutes will do it.

The consequences for a WordPress site are serious. The FTP password usually gives access to every file, including wp-config.php and the uploads folder. An attacker can add a backdoor to a theme, redirect your visitors or host something unpleasant on your domain.

The fix is not complicated. Use SFTP, or FTPS with TLS required. Avoid public Wi-Fi when you work on a live site. Use a unique password, stored in a password manager, so a leak on one site does not unlock all of them.

And please, never use a seasonal password like “Spring2026!” for anything. It looked clever once. Password guessing lists know every seasonal pattern.

Credit: Thank you to Claude for writing this filler content. It is an unsupervised learning task.