How to Check FTP Accounts After a WordPress Hack in 2026
If your WordPress site has been hacked, FTP accounts are one of the first places to inspect for unauthorized access.
This guide explains how to check FTP accounts after WordPress hack incidents, identify suspicious logins, and remove the back doors attackers often leave behind.
FTP access can expose your entire web root, so even a single compromised account can lead to reinfection, defaced files, or data theft.
Knowing where to look and what to compare can save hours of cleanup and help you secure the site faster.
Why FTP accounts matter after a WordPress compromise
WordPress itself is only one layer of a website.
Attackers often target the hosting account, FTP credentials, and related control panel access because these paths let them upload malicious PHP files, modify wp-config.php, and plant persistent malware.
Common risk points include:
- Shared hosting accounts with multiple FTP users
- Legacy FTP accounts that were never deleted
- Weak passwords reused across hosting and email
- Compromised credentials stored in local FTP clients
- Unauthorized changes to file permissions and ownership
FTP is especially important to review because file-level access can bypass WordPress security plugins and allow attackers to hide malware outside the normal dashboard.
Where to find FTP accounts
The exact location depends on your hosting provider, but FTP accounts are usually managed in cPanel, Plesk, DirectAdmin, or the host’s custom dashboard.
If you use managed WordPress hosting, FTP may be replaced or supplemented by SFTP, SSH, or a separate developer access system.
Check these places first
- Hosting control panel: Look for FTP Accounts, Files, or User Management.
- Hosting billing or support portal: Some providers list additional access users there.
- Server configuration files: On certain systems, FTP users are mapped to system accounts.
- Local FTP client settings: Saved sites in FileZilla, Cyberduck, WinSCP, or Transmit may reveal old hosts and usernames.
Compare the accounts you find against the people who should legitimately have access: site owners, developers, agencies, or maintenance staff.
How to check FTP accounts after WordPress hack
Start by building a clean inventory of every FTP or SFTP account associated with the hosting account.
Then compare that inventory with your known users, recent activity, and any changes made around the time of the hack.
1. Export or list all FTP users
In cPanel, open the FTP Accounts section and record every username, directory path, and last-used detail if available.
In Plesk or similar panels, check the list of system users or subscriptions tied to the site.
Look for:
- Accounts you do not recognize
- Generic names such as admin, test, backup, temp, or dev
- Multiple accounts pointing to the same document root
- Accounts with broad access to the entire site instead of a limited folder
2. Review account creation and modification dates
If the panel shows creation timestamps, compare them with the suspected compromise window.
A new FTP account created shortly before or during the hack is a major red flag.
Even if the date is not visible in the interface, hosting logs, audit logs, or server support can often confirm when the account was added or changed.
3. Check login activity and source IP addresses
Some hosts provide FTP log files or security logs that show successful and failed logins.
Review the source IP addresses and compare them with your own office, home, developer VPN, and hosting provider access patterns.
Suspicious signs include:
- Repeated logins from unfamiliar countries or cloud providers
- Access at unusual hours
- Multiple failed attempts followed by a success
- Short bursts of file uploads or deletions
4. Inspect directory access and file changes
A hacked FTP account is often used to modify specific files such as wp-config.php, .htaccess, index.php, or theme template files.
Review recent file changes in the hosting file manager, backup system, or server logs.
Pay special attention to:
- New PHP files in wp-content/uploads
- Modified core WordPress files
- Injected code in functions.php or header.php
- Odd file names that imitate images, plugins, or cache files
5. Compare account access with team records
Every FTP account should map to a real person, role, and purpose.
If a former contractor, agency, or temporary developer still has access, remove it immediately unless there is a documented reason to keep it active.
Use a simple access matrix:
- Username
- Person or team
- Access level
- Allowed directories
- Last login date
- Reason for retention or removal
Signs an FTP account may be compromised
Some attackers do not create new accounts; they steal existing credentials.
You should assume compromise if an FTP account shows unusual behavior, even when the username is familiar.
Watch for these indicators
- Recent uploads of unfamiliar PHP or executable files
- Unexpected edits to plugin, theme, or configuration files
- Repeated login failures from one username
- Passwords that still work even after being changed elsewhere
- Files with timestamps that match the attack window
If an account was used from a device that might have malware, the threat may persist until the password is changed and all saved credentials are removed from FTP clients and browsers.
What to do with suspicious FTP accounts
When you find an account you cannot verify, disable it immediately.
If you need the account for evidence or forensic review, change its password, limit its access path, and preserve logs before deletion.
Recommended response steps
- Disable the account or change its password.
- Revoke any stored API keys or hosting credentials tied to the same user.
- Remove access from all FTP clients and devices.
- Delete unknown accounts after preserving evidence if needed.
- Scan the site for injected files, backdoors, and modified templates.
If the host supports SFTP or SSH keys, switch away from plain FTP.
FTP transmits credentials without modern encryption unless it is explicitly wrapped in secure protocols.
Secure the FTP layer after cleanup
After the immediate incident response, tighten the access model so a single stolen password does not expose the site again.
The goal is to minimize who can connect, where they can go, and what they can change.
- Use SFTP or SSH instead of traditional FTP
- Enable two-factor authentication in the hosting panel
- Assign least-privilege directory access
- Delete unused accounts and old credentials
- Store passwords in a password manager, not in email or plain text
- Review audit logs regularly
You should also rotate WordPress admin passwords, database credentials, and any deployment keys because FTP compromise often happens alongside broader credential theft.
Tools and logs that help during investigation
Several host-level and WordPress-side tools can help you trace what happened without relying on guesswork.
The best evidence usually comes from combining hosting logs, file timestamps, and backup diffs.
Useful sources of evidence
- FTP or SFTP logs: show login attempts and transfers
- File manager activity logs: reveal account actions in the panel
- Backup snapshots: help identify the first infected version
- Security plugins: may record file integrity changes
- Server access logs: correlate requests with suspicious uploads
If you are using a managed host, support can often provide log excerpts or point out whether an FTP account was created, used, or deleted during the intrusion.
Prevent future FTP-based reinfection
Attackers frequently return through the same weakness if the hosting environment is not hardened.
Cleaning the site without changing access controls leaves the door open.
Best practices include:
- Audit FTP and SFTP accounts monthly
- Remove temporary accounts after every project
- Use separate credentials for each developer
- Restrict write access to only necessary folders
- Monitor for new file creation in wp-content
- Keep local computers malware-free and updated
When a WordPress hack involves FTP, the fastest path to recovery is often a disciplined account review, a log comparison, and a full credential reset.
The more complete your audit, the less likely the attacker is to regain access through an overlooked account.