How to Delete an FTP Account in ISPConfig

This guide covers removing an FTP login from a website on your Noiz hosting through the ISPConfig control panel, and the two consequences that catch people out afterwards. In ISPConfig the account is called an FTP User; you may see the same thing called an FTP account or an FTP login elsewhere. Deleting one takes about ten seconds. Working out what depended on it takes longer, so most of this guide is about that.

Last reviewed: 27 July 2026, against the current ISPConfig release. This guide is written for Noiz hosting and is kept current against ISPConfig. It complements, and does not replace, the official ISPConfig documentation linked below.

Official Documentation Reference

• ISPConfig 3 User Manual: the official manual, including the Sites > Web Access > FTP-Accounts reference for every field on the FTP user form.
• ISPConfig Documentation index: the full list of official ISPConfig documentation.

Prerequisites

• You can log in to the ISPConfig control panel.
• The FTP account belongs to a website on your own hosting account. You cannot see or delete FTP users belonging to another client.
• You know, or are about to work out, what has been using the credentials. The section below is there to help with that.

What Deleting Actually Does

An FTP user in ISPConfig is a set of credentials stored in a database, not a person and not a folder. Deleting it removes the ability to log in with that username and password. Nothing else changes. Two specific points are worth being clear about before you click anything.

The files are not deleted

Everything the account could reach stays exactly where it is. Your website keeps serving, the contents of web and private are untouched, and anything the account uploaded remains on disk. Deleting an FTP user is a credentials operation, never a cleanup operation.

This matters most when the reason for deleting is that you no longer trust whoever had the login. Removing the account closes one door, and the files that person left behind are still live: an abandoned admin script, a forgotten upload folder or a modified theme file will keep working after the account is gone. If you want those files removed, remove them first, while you still have a working way in, and only then delete the login. Reversing the order means creating a fresh account just to finish the tidy-up.

It is also worth remembering that FTP is one door among several. A shell user (listed in ISPConfig as SSH/SFTP-User under Command Line), a database user, or a WordPress or other application login are separate credentials and are unaffected. If you are cutting off access properly rather than tidying up, check each of those too.

Anything using the credentials starts failing

This is the one that generates support tickets a fortnight later. FTP logins tend to end up saved inside tools that nobody thinks about day to day:

• Backup plugins and backup services that push a copy of the site to remote storage over FTP.
• Deployment tooling: a CI pipeline, a build script, or the saved deployment profile in an editor or IDE.
• Cron jobs or scheduled scripts that call lftp, curl or wget with the username baked into the command.
• Saved site profiles in FileZilla, WinSCP or Cyberduck belonging to a designer or developer who is still working on the site.

The awkward part is that these failures are usually quiet. A backup job often reports that it ran, because the local archive was created successfully, and only the remote upload step failed. You find out when you need the backup. Before deleting, check the tools you know connect to the site, and note the account's Website value on the FTP User tab along with the Directory path on the Options tab: a login confined to a single subfolder is almost always a tool or a limited contractor rather than a general-purpose login.

One useful distinction: a tool connecting on port 22 is using SSH or SFTP, which is a shell user, not an FTP user, and deleting an FTP account will not affect it. Only connections on port 21 are affected.

Disable First If You Are Not Certain

ISPConfig lets you switch an account off without destroying it, and when you cannot account for everything that might be using a login, this is the better first move.

1. Open Sites > Web Access > FTP-Accounts and click the account name to open it.
2. On the FTP User tab, untick Active, then click Save.

Logins are refused immediately, the settings and the directory restriction are preserved, and re-ticking the box restores the account with the same password. Leave it disabled for a week or two, and anything that quietly depended on it will surface. There is also an Expire at field on the Options tab if you would rather set a date and let ISPConfig disable the account for you. On a client login that tab is short: Directory and Expire at only, because the file quota, ratio, bandwidth and UID or GID fields are administrator-only.

The one thing disabling does not do is free up capacity. A disabled account still counts towards the Max. number of FTP users limit on your hosting plan, so if you are deleting in order to create a new account and have hit the limit, you need an actual deletion.

Delete the FTP Account

1. In the ISPConfig control panel, click Sites, then FTP-Accounts under Web Access in the left menu. The list it opens is headed FTP-User, which is the same thing.
2. Find the account in the list. The Username column shows the full username including the automatic client prefix, so an account created as deploy appears as something like client1deploy. Match on the full string, and check the Website column if similar names exist across several sites.
3. Click the delete icon at the right-hand end of that row.
4. Confirm when ISPConfig asks Do you really want to delete this record? There is no undo.

Confirm It Worked

The account disappearing from the list means ISPConfig has accepted the change, not that the FTP server has applied it yet. Watch the small red change indicator near the top of the panel: while it is showing, the deletion is still being written out to the FTP server in the background. The list itself names the outstanding job, as Delete FTP user, and ISPConfig's own wording is that storing updates can take up to one minute.

Once it has cleared, prove the deletion rather than assuming it. Open your FTP client and try to connect with the old username and password. A correct result is a rejected login, usually reported as an authentication or 530 error. If you would rather check from the site's side afterwards, the website usage and log tools will show whether anything is still attempting to connect.

An FTP session that was already open when you deleted the account may continue until it disconnects. If you are cutting off access urgently, confirm no session is still live rather than relying on the deletion alone.

Troubleshooting

• The account is not in the list at all: the list only shows FTP users on websites assigned to your client login, so an account on another client's site never appears. If you are certain it should be there, open a support ticket with the full username and the website it belongs to.
• Deleting returns a permissions message: ISPConfig answers You dont have the permission to delete this record! when your login can see the record but is not allowed to remove it. Retrying will not help, so raise a support ticket.
• The account is still listed after confirming: refresh the list. If it persists and the red change indicator has cleared, the deletion did not reach the FTP server, and that needs a support ticket.
• The old credentials still work a few minutes later: either the change indicator has not cleared yet, or your FTP client is reusing an existing connection. Disconnect fully, close the client, and try again.
• You deleted the wrong account: no files were harmed. Create a new FTP account using the same short username and the same website, and the full prefixed username will come out identical. The password will be a new one, so anything storing the old password still needs updating.
• A backup or deployment started failing shortly afterwards: it was using the deleted credentials. Rather than recreating the same login out of habit, decide whether that tool should still have write access, then either create a fresh account scoped to the directory it actually needs or remove the integration.
• A limit message blocks you from recreating the account: clicking Add new FTP-User answers The max. number of FTP users for your account is reached. and the form never opens. Disabled accounts still occupy a slot, so deleting one you genuinely no longer need is the fix, not disabling another.

If you are not sure which FTP account a tool is using, or you need help checking what a departing developer left behind before you remove their access, open a support ticket with the Noiz support team. Include the website domain and the full FTP username as it appears in the FTP-User list under Web Access.