SFTP

SFTP is often confused with two other protocols. Plain FTP is the old file transfer protocol that sends passwords and files unencrypted, so anyone on the network path can read them. FTPS is FTP with TLS encryption added, which is secure but a different protocol from SFTP. SFTP is part of SSH, the same secure system developers use to log into servers, and is not FTP at all despite the name.

For a website owner, SFTP is simply the safe way to reach the site's files when a developer or a tool needs to change them directly. Day-to-day editing happens in the CMS, but SFTP is how files are reached when the admin area itself will not load, for example after a failed update.

How it works

An SFTP client, a program such as FileZilla, WinSCP or Cyberduck, connects to the server's address on the SSH port, usually 22. The server proves its identity with a host key; the client remembers it and warns you if it ever changes, which could mean the connection is being intercepted. You then log in with a username and either a password or, better, an SSH key: a private key stored on your computer that matches a public key placed on the server.

Once connected, the client shows the server's folders next to your own. You can drag files up and down, rename and delete them and change their permissions, which decide who may read, write or execute each file. Everything moves through the encrypted channel, so a coffee-shop network or a compromised router cannot see the files or the credentials.

On shared hosting, SFTP access depends on the host: some include it with every plan, some need it enabled, and some only offer FTP or FTPS. On a VPS, SFTP comes with SSH and is usually available by default.

Example

A bakery's developer needs to replace a broken theme file. The host's panel offers FTP, FTPS and SFTP; the developer uses SFTP with an SSH key, so no password crosses the network at all. The bakery's owner, who prefers not to share the main hosting login, creates a separate SFTP user in the hosting panel that can only reach the website folder.

When the work is done, the owner removes that user. Months later, an automated security scan reports that plain FTP is still enabled on the account; it is switched off in the panel because nobody uses it.

Why it matters for your business

Using SFTP instead of plain FTP removes a simple route for stolen passwords and tampered files, and it costs nothing extra where it is offered. Separate SFTP accounts per person or supplier, removed when the work is finished, keep access under control. For regular code changes, a deployment process through Git is safer still, because every change is recorded and can be undone. SFTP remains the practical tool for one-off fixes and for hosts without that setup. Ask your host which protocols are switched on for your account, and turn off any you do not use.

Common mistakes

• Using plain FTP because it is the default in the client, sending passwords unencrypted.
• Sharing one login with every supplier and never removing it after the work ends.
• Ignoring a changed host key warning instead of checking with the host why it changed.
• Editing files on the live server directly with no copy of the originals to fall back on.

Questions people ask

What is the difference between SFTP and FTP?

FTP sends usernames, passwords and files unencrypted, so they can be intercepted. SFTP runs over SSH and encrypts everything, including the login. They are different protocols, so a server and client must both support SFTP. Where a host offers it, there is no good reason to keep using FTP.

What is the difference between SFTP and FTPS?

Both are encrypted. FTPS is the old FTP protocol with TLS encryption added, typically using port 21 or 990 and extra ports for data. SFTP is part of SSH and uses a single connection, usually on port 22. Which one you use depends on what your host supports.

What do I need to connect with SFTP?

You need an SFTP client such as FileZilla, WinSCP or Cyberduck, plus the server address, port, username and a password or SSH key from your host or developer. Check the host key on first connection, and save the site in the client so you do not retype details.