Identify the exact username in the transfer client and determine whether it is an additional FTP account or the main subscription system user. List deployment jobs, backup clients or authorized shell connections that may use it before rotating the credential.

1. For an additional account, open the domain FTP Access page and select that username.
2. For the main system user, open the domain Hosting & DNS > Web Hosting Access or equivalent current hosting-access page.
3. Enter and confirm a strong unique password in the appropriate account form, then save. Keep the password in approved secret storage.
4. Update authorized transfer clients and deployment automation. If the same system user also provides permitted SSH access, review how that authentication is configured and whether password-based consumers need updating.
5. Test a fresh encrypted transfer connection and perform the required read or write operation within the intended directory.

Confirm the new credential works for the correct account and that deployment jobs resume normally. Keep the Plesk panel account and each additional FTP account distinct in your password manager.

If access fails, compare the username, server, protocol and port before resetting another account. SSH key authentication may remain valid independently of a password change and must be reviewed separately during an incident. For a suspected compromise, inspect uploaded files and other access methods as well as rotating the password.

• Creating a restricted FTP account in Plesk
• Changing an FTP username in Plesk
• Removing an additional FTP account in Plesk
• Changing your Plesk customer-account password

• Plesk: Changing FTP Access Credentials
• Plesk: Adding FTP Accounts