Guide
What is SFTP and how do you use it?
SFTP, the SSH File Transfer Protocol, is a secure way to upload, download and manage files on your hosting account from your computer. You use a free client such as FileZilla or WinSCP, enter your host name, username, password and port, and drag files between your computer and the server. Unlike plain FTP, everything, including your password, is encrypted in transit.
The picture
How an SFTP connection works
- Your computerRuns an SFTP client
- Encrypted tunnelPassword and files are protected
- Your hosting serverAccepts the login
- Your site folderFiles appear in a list
- TransferUpload, download, edit, delete
Definition
What SFTP means, in everyday terms
When you build a website by hand, or when you need to fix a file that WordPress itself cannot edit, you have to get files from your computer onto the server that hosts your site. SFTP is the standard way to do that. Think of it as a file manager for a remote computer. You see your own folders on one side of the screen and the server's folders on the other, and you move files between them.
The "S" stands for secure. SFTP runs over SSH, the same encrypted channel that administrators use to log in to servers. Your username, password and every file travel through that channel, so nobody on a cafe Wi-Fi network or along the route can read them.
Do not confuse SFTP with FTPS, which is plain FTP wrapped in TLS encryption. The two sound alike and many clients support both, but they are different protocols with different default ports. When your host gives you SFTP details, choose SFTP in the client.
Comparison
SFTP, FTPS and plain FTP
| Feature | SFTP | FTPS | Plain FTP |
|---|---|---|---|
| Encrypted | Yes, via SSH | Yes, via TLS | No |
| Typical port | 22 | 21 plus extra ports for data | 21 |
| Password sent in clear text | No | No | Yes |
| Firewall friendliness | Simple, one port | Can be awkward | Can be awkward |
| Should you use it | Yes, first choice | If SFTP is unavailable | Avoid |
Ports are standard defaults. Check the connection details for your own account in the client area, as they can differ.
Hosting that includes the tools you need
Unlimited subdomains and MySQL databases, free SSL and one-click WordPress on every plan.
Choosing a client
Free programs you can use
You need an SFTP client on your computer. FileZilla is free and available for Windows, macOS and Linux. WinSCP is a popular free option on Windows. Cyberduck is free on macOS and Windows. Many code editors also have SFTP extensions that let you save a file straight to the server.
Download the program from its official website only. Fake download pages for popular tools sometimes bundle unwanted software. If an installer asks you to accept extra toolbars or offers, decline them, or download again from the maker's own site.
Connecting
How to connect with an SFTP client
Find your login details
Look in your hosting welcome email or client area for the host name, your username and the port. If SFTP is not obviously listed, ask on live chat.
Open the connection screen
In FileZilla, open the Site Manager and create a new site. In WinSCP, start a new session.
Choose the protocol
Select SFTP (sometimes shown as SSH File Transfer Protocol). Do not pick plain FTP.
Enter host, port, user and password
Type the host name, the port (commonly 22), your username and your password. Save the site so you do not retype it.
Accept the server key
The first time you connect, you are asked to trust the server's fingerprint. Accept it if it matches what your host gave you.
Move to the right folder
Open your website folder, usually named public_html or similar, and drag files across.
Where files go
Which folder do my files belong in?
Your hosting account has a main website folder, often called public_html. Whatever you put there is reachable on the internet. An index.html or index.php file in that folder is what visitors see when they type your domain. Files outside it are not publicly reachable, which makes it the right place for anything private.
If you have addon domains or subdomains, each normally has its own folder inside or beside the main one. Check the document root shown for each domain in your control panel before uploading, and upload into that folder, not the main one. A common mistake is to upload a second site into the first site's folder, where it appears at the wrong address.
Keep your folder structure tidy. Use lowercase file names without spaces, such as contact-us.html, because servers treat upper and lower case as different and spaces become awkward in links.
Choosing
SFTP or the control panel file manager?
Use SFTP when
- Uploading many files or whole folders
- Replacing a full WordPress theme or site
- Working with a developer who needs access
- Syncing changes from a code editor
- Resuming a large transfer that was interrupted
Use the file manager when
- Making a quick edit to one file
- You are on a computer without a client
- Checking permissions or hidden files
- Extracting a zip file on the server
- Fixing something while away from your usual machine
Fixing problems
Common SFTP errors and what they mean
Authentication failed
The username or password is wrong, or the account has a restricted login. Retype carefully and reset the password if needed.
Connection timed out
Often a wrong host name or port, or a firewall at your end. Try another network.
Permission denied
The folder is not writable by your account. Check that you are in your own site folder.
Host key changed
Appears after a server move. Verify with us before accepting a new key.
Files upload but nothing changes
You may be looking at a cached page, or uploaded into the wrong folder.
Still stuck
Send our live chat the exact error text and which client you use.
Safe habits
Using SFTP safely
- Always choose SFTP, not plain FTP
- Use a strong, unique password
- Do not save passwords on shared computers
- Remove accounts for people who no longer need access
- Back up before replacing important files
- Never leave config files with passwords publicly readable
- Upload from sources you trust
- Log out when finished
Good practice
Backups and permissions
Before you overwrite anything important, download a copy of the existing file. SFTP does not have an undo button, and replacing a working file with a broken one is easy. We keep weekly remote backups for about a month, but a copy taken a minute earlier is far fresher. See how to back up a website.
File permissions control who can read, write and run a file on the server. Most uploaded files work with the defaults. If something seems stuck, do not set permissions to open to everyone as a quick fix. That weakens security. Ask for help, and we will point you to the right setting.
Automation
Syncing and editing without dragging files
Once you are comfortable with SFTP you can save time. Most clients can compare a local folder with the server and upload only what changed, and many code editors can save straight to the server each time you press save. This is convenient, but it also means a mistake goes live instantly, so for anything important work on a staging copy first.
If several people need access, give each person their own login rather than sharing one, and remove it when they finish. That way you can see who did what, and one lost password does not force everyone to change theirs. Ask our live chat if you are unsure how to set up an extra login.
FAQ
Common questions
Is SFTP the same as FTP?
No. FTP sends passwords and files unencrypted. SFTP runs over SSH, so everything is encrypted.
Which SFTP client should I use?
FileZilla and WinSCP are widely used free clients. Cyberduck is a good option on macOS.
What port does SFTP use?
The usual default is 22, but check the details for your own account in the client area.
Do I need SFTP to run WordPress?
No. You can manage WordPress entirely from its dashboard. SFTP is useful for manual uploads and fixing problems.
Can a developer use SFTP without my main password?
Ask us about creating a separate login, and remove it when the work ends.
Keep reading
Related pages
Host a site you can manage your way
WordPress one-click installs, or upload your own files. Live chat is open 24/7.