Yes we are using Apache, and yes we are uploading to our home directories using FTP.

My main issue is that I've never seen a server do this. Even paid hosts that are supposed to be fairly secure allow you to upload to your web directory. He's trying to tell me that everyone does this, but I haven't seen anyone do it.

I can no longer use the built-in FTP in programs like dreamweaver, becaues I'd have to login to the machine anyway to move the file, so I might as well do it all at once.

Plus, we would be using twice as much disc space on the server, because there'd be a copy in my home directory and a copy on the web directory.

I guess what I really want to know is how do the big guys (the expensive web hosts) do it and stay secure?