# One Account Per Site, and Other Acts of Kindness

- Link: https://test.srtafe.com.au/one-account-per-site-and-other-acts-of-kindness/
- Published: 2026-10-14T09:00:00+08:00
- Author: Wordpress Administrator

It is tempting to use one FTP account for everything. It saves time, until a plugin
gets compromised and the attacker discovers that one login opens every site you 
manage.

Give each site its own FTP account, restricted to that site’s folder. If one gets
compromised, the damage stays in one place. It also makes your logs readable, because
you can see which account did what.

Use strong, unique passwords stored in a password manager, and change the defaults
that came with the hosting package. Default passwords are well known, and attackers
try them first, politely.

Limit access by IP address where you can, and disable anonymous FTP completely. 
Nobody needs strangers wandering around your upload folder.

Finally, remember people leave. When a student, contractor or colleague finishes,
remove their account and change any shared passwords. An old login that nobody remembers
is the most reliable door into a website, and the one nobody is watching.

Security is mostly a matter of boring housekeeping. It is not glamorous, but neither
is explaining to a client how their site ended up selling imitation watches.

_Credit: Thank you to Claude for writing this filler content. It is an unsupervised
learning task._