Choose the site root and account scope first
Check the target website and physical directory in the file manager. Customer operations are scoped to their own sites. Where directory names look similar, verify the domain-to-directory mapping before uploading.
Prepare a production package separately from the source repository. Exclude .git, development secrets, SQL backups and private keys. Decide explicitly whether existing .env files, user uploads and work files should survive the new version.
Understanding FTP, FTPS and SFTP
Creating an FTP account does not establish encryption. FTPS protects FTP with TLS; SFTP is a different protocol based on SSH. Select the protocol actually supported by the server and validate the certificate it presents.
The control connection may succeed while listing or uploading fails. Passive data ports, NAT and firewall rules affect this stage. Distinguish authentication rejection from data-channel timeouts in the client log; do not disable TLS validation to diagnose it.
Updating an existing website
- Back up live files and the application database.
- Inspect the new package separately and exclude production secrets and backups.
- List .env, upload and working files that must be retained.
- Verify the destination and permissions, then upload changed files deliberately.
- Test the homepage, login, uploads, database operations and assets over HTTPS.
- Use the previous version for recovery if necessary; do not leave the archive in a publicly accessible directory.
Evaluating filesystem permissions
Grant the application identity read access and write access only in directories that require it, such as upload or cache locations. Giving everyone full control of the whole site can increase the impact of an application vulnerability.
An archive may contain an unexpected parent directory, filename or configuration. Inspect its structure before extracting into the live root. Afterwards, confirm IIS can read the configuration and the application runs from the intended directory.
Test direct URL access as well
Use actual HTTP requests to check that private files and backups are inaccessible. An obscure filename, missing navigation link or robots.txt rule is not access control. Remove temporary test files after deployment and retain needed backups outside public web access.
Frequently asked questions
Why can FTP login work while directory listing fails?
The control channel may work while the passive data channel is blocked. Inspect client logs, NAT and passive port configuration together.
Does a new package automatically preserve .env?
Do not assume that for every upload or extraction workflow. Identify files to preserve and compare them with the destination before replacement.