If you need to move files between your computer and your hosting account, you'll usually choose between two protocols: FTP and SFTP. Both get files from point A to point B, but they are not equally safe to use. Here's what sets them apart and which one you should pick.
What Is FTP?
FTP (File Transfer Protocol) is the older, more traditional way to upload and download website files. It's simple to set up and widely supported by file transfer applications, but it sends your username, password, and file contents in plain text. Anyone intercepting your connection, for example on an unsecured public Wi-Fi network, could potentially read your login details.
What Is SFTP?
SFTP (SSH File Transfer Protocol) does the same job as FTP, moving files to and from your hosting account, but it runs over an encrypted SSH connection. Your login credentials and the files themselves are scrambled in transit, so even if someone intercepts the connection, they can't read what's being sent.
Despite the similar name, SFTP is not simply "FTP with a security setting turned on." It's a different protocol entirely, using a different port (22 instead of FTP's port 21).
Key Differences
- Security: FTP transmits data in plain text; SFTP encrypts everything.
- Port used: FTP typically uses port 21; SFTP uses port 22 (the same port as SSH).
- Firewall friendliness: SFTP uses a single connection, which tends to work more reliably through strict firewalls than standard FTP.
- Setup: Both use the same account credentials on your hosting account, so switching from FTP to SFTP in your file transfer app usually just means changing the protocol and port.
Which Should You Use?
Use SFTP whenever it's available. There's no real downside to it, and it protects your login details and website files from being exposed on the network. Only fall back to plain FTP if your file transfer application or an older workflow genuinely doesn't support SFTP.
If your FTP account password is also used elsewhere, switching to SFTP is especially worthwhile: it prevents that password from ever being sent unencrypted.
How to Connect
Both cPanel and DirectAdmin support SFTP using the same username and password as your regular FTP account, no separate setup required.
- Open your file transfer application (such as FileZilla).
- Enter your hosting account's server address as the host.
- Enter your FTP account username and password.
- Set the port to 22 and the protocol to SFTP (in FileZilla, choose "SFTP: SSH File Transfer Protocol" from the protocol dropdown, rather than typing the port manually).
- Connect. You should see your website's files listed just as you would over regular FTP.
If you don't have an FTP account set up yet, see How to Create an FTP Account first, the same credentials will work for SFTP.