In three-dimensional (3D) photonic crystals, refractive-index variations with a periodicity comparable to the wavelength of the light passing through the crystal give rise to so-called photonic bandgaps, which are analogous to electronic bandgaps for electrons moving in the periodic electrostatic potential of a material's crystal structure. Such 3D photonic bandgap crystals are envisioned to become fundamental building blocks for the control and manipulation of photons in optical circuits. So far, such schemes have been pursued by embedding artificial defects and light emitters inside the crystals, making use of 3D bandgap directional effects. Here we show experimentally that photons can be controlled and manipulated even at the 'surface' of 3D photonic crystals, where 3D periodicity is terminated, establishing a new and versatile route for photon manipulation. By making use of an evanescent-mode coupling technique, we demonstrate that 3D photonic crystals possess two-dimensional surface states, and we map their band structure. We show that photons can be confined and propagate through these two-dimensional surface states, and we realize their localization at arbitrary surface points by designing artificial surface-defect structures through the formation of a surface-mode gap. Surprisingly, the quality factors of the surface-defect mode are the largest reported for 3D photonic crystal nanocavities (Q up to approximately 9,000). In addition to providing a new approach for photon manipulation by photonic crystals, our findings are relevant for the generation and control of plasmon-polaritons in metals and the related surface photon physics. The absorption-free nature of the 3D photonic crystal surface may enable new sensing applications and provide routes for the realization of efficient light-matter interactions.