For most of the web’s history, FTP was how you moved files between your computer and your web server. It worked. It was everywhere. Every host supported it. Every tutorial used it. Most people did not think much about it.
The problem is that FTP is insecure in ways that matter today. It sends passwords in plain text. It sends file contents in plain text. Anyone on the network between you and your server can read everything as it goes by.
SFTP solves this. The name is similar (just an S in front), but the technology is different. SFTP encrypts everything between your computer and the server, making file transfer secure.
This piece covers what FTP and SFTP actually are, why the difference matters, and how to use SFTP for your site.
What FTP Actually Is
FTP stands for File Transfer Protocol. It was developed in 1971, which is before most current internet technologies existed. The protocol has been updated over the years, but the core design comes from a different era.
How FTP Works
You run an FTP client on your computer. You connect to an FTP server on your hosting account. You enter a username and password. You upload, download, or modify files.
The connection uses two channels. A control channel for commands and a data channel for file contents. Both are unencrypted by default.
What Plain Text Means
Plain text means the data travels in a readable form. Anyone with access to the network can intercept the data and read it.
When you log into FTP, your password travels across the network in plain text. Anyone watching the network sees your password directly. No decryption needed. No special tools required beyond basic network monitoring.
When you upload a file, the file contents travel across the network in plain text. Anyone watching sees the file as you upload it.
Why This Matters
The web has changed a lot since 1971. Networks are no longer trusted environments. Coffee shop Wi-Fi, airport networks, public hotspots, even corporate networks. Plenty of places where someone could be monitoring traffic.
Sending your hosting password in plain text across one of these networks is risky. Sending the entire contents of your website in plain text is risky in different ways.
FTPS Confusion
Sometimes people use FTPS to mean FTP with SSL encryption. This is a separate protocol from SFTP. FTPS adds encryption to FTP. SFTP is built on SSH.
FTPS is technically secure when configured correctly, but the configuration is more involved and prone to errors. SFTP is generally simpler and more reliable.
For practical purposes, use SFTP unless you have a specific reason to use FTPS.
What SFTP Actually Is
SFTP stands for SSH File Transfer Protocol. The S at the beginning refers to SSH (Secure Shell), the underlying technology.
How SFTP Works
SFTP runs on top of SSH. When you connect, the SSH layer establishes an encrypted tunnel between your computer and the server. Everything that goes through the tunnel (file transfers, commands, passwords) is encrypted.
From the user perspective, SFTP feels like FTP. You connect with a client, enter credentials, and transfer files. The interface is similar.
The difference is what happens to the data on the network. Encrypted instead of plain text.
What Encryption Means in Practice
When you log in via SFTP, your password is encrypted before it leaves your computer. The server decrypts it after receiving it. Anyone watching the network in between sees random gibberish, not your password.
Same for file contents. Files get encrypted as they leave your computer, travel across the network in encrypted form, and get decrypted on the server.
The encryption is the same kind that protects HTTPS websites. It is well-tested, widely deployed, and considered secure for the foreseeable future.
Authentication Methods
SFTP supports password authentication, which works like FTP. You enter your password and you are in.
SFTP also supports key-based authentication. You generate a key pair (a public key and a private key). You install the public key on the server. You keep the private key on your computer. To connect, the client and server verify the keys instead of using a password.
Key-based authentication is stronger than passwords. It is also more convenient once set up because you do not have to enter a password every time.
The Differences That Matter
For most users, the practical differences come down to a few specific points.
Security
SFTP is secure. FTP is not. This is the main difference.
If you use FTP from a public network, your credentials and files are exposed. If you use FTP from anywhere, the data crosses multiple networks before reaching your server. Any of those networks could be compromised.
SFTP closes this vulnerability. The encryption protects against eavesdropping regardless of what network you are on.
Port & Protocol
FTP uses port 21 by default for the control channel and other ports for data. The configuration can be complicated, especially behind firewalls.
SFTP uses port 22, the same port as SSH. The single-port design makes it easier to work with firewalls and NAT setups.
Speed
For most users, the speed difference between FTP and SFTP is small. The encryption adds some overhead but modern computers handle it without noticeable impact.
Very large transfers might see slightly slower performance with SFTP, but the difference is usually under 10 percent.
Server Support
Almost every modern host supports SFTP. Some still support FTP for backward compatibility. A growing number have disabled FTP entirely because of the security issues.
If your host offers both, use SFTP. If they only offer FTP, consider moving to a host that supports SFTP.
How to Use SFTP
The practical setup is straightforward.
Pick an SFTP Client
Most FTP clients also support SFTP. FileZilla, Cyberduck, WinSCP, Transmit. These all work with both protocols.
When you set up the connection, select SFTP as the protocol instead of FTP. The settings are similar otherwise.
Get the Connection Details
Your host provides the connection details. Server address (usually your domain or a host-provided hostname). Port (22 by default for SFTP). Username. Password or key.
These details often appear in your hosting control panel under FTP or SFTP settings.
Connect
Enter the connection details in your client. Click connect. You should see your site’s files appear.
The first time you connect, the client may ask you to verify the server’s key. This is a security measure that confirms you are connecting to the right server. After the first connection, the client remembers the key.
Transfer Files
The interface should look like FTP. Drag and drop files between your computer and the server. The transfers happen over the encrypted connection.
Set Up Key-Based Authentication
Once you are comfortable with password-based SFTP, consider moving to key-based authentication.
Generate an SSH key pair using your client or a command-line tool. The public key gets installed on the server. The private key stays on your computer.
When you connect, the client uses the private key to authenticate. No password needed. The setup is more secure and more convenient once it works.
Common SFTP Misconceptions
A few myths about SFTP keep circulating.
“SFTP Is Slower”
Mostly false. The encryption overhead is small on modern hardware. For typical transfers, you will not notice a difference.
For very large bulk transfers over slow connections, the difference might be measurable. For typical web development workflows, it is invisible.
“SFTP Is More Complicated”
False. From the user perspective, SFTP works just like FTP. Same kind of client, same kind of interface, same kind of workflow.
The complexity is hidden in the protocol. Users see the simple interface.
“I Do Not Need Security for My Files”
Some users think their files are not sensitive enough to bother with encryption. This misses the bigger issue. Even if your files are not sensitive, your password is. If someone steals your hosting password via FTP, they have control of your entire site.
The security matters even for “non-sensitive” files because of what the password protects.
“FTP Is Fine on My Home Network”
The risk is not just at coffee shops. Your traffic crosses multiple networks between your home and your hosting server. Your ISP, internet backbone providers, the host’s network. Any of these could be compromised.
Plus, FTP on your home network can still be intercepted by other devices on the same network. If your router gets compromised, all your FTP traffic is exposed.
When You Might See FTP Still
A few legitimate use cases still exist for FTP, but they are narrow.
Internal Networks
In some enterprise environments, FTP is used on isolated internal networks where security can be controlled at the network level. For most users, this does not apply.
Anonymous File Distribution
Public file repositories sometimes use anonymous FTP to distribute files. The lack of authentication means there is no password to steal. This is uncommon today but exists.
Legacy Systems
Some older systems only support FTP. If you must work with them, FTP may be required. But for modern web development, the systems that require FTP are increasingly rare.
For typical website work, none of these apply. SFTP is the right choice.
Hosts That Have Moved Past FTP
Some hosts have disabled FTP entirely.
Premium Managed Hosting
Kinsta, WP Engine, and several other premium managed hosts no longer offer FTP. They provide SFTP only. The reasoning is straightforward: FTP is insecure and there is no good reason to support it.
Cloud Platforms
AWS, Google Cloud, and Azure do not provide FTP for typical workflows. SFTP and SSH are standard.
Some Mid-Tier Hosts
A growing number of mid-tier hosts have phased out FTP or default to SFTP. The transition is gradual but the direction is clear.
If your host still uses FTP as the default, that is a yellow flag. The host is behind the times on security.
Other Secure Alternatives
Beyond SFTP, a few other secure file transfer options exist.
SCP
SCP (Secure Copy) is another SSH-based file transfer tool. It is simpler than SFTP but more limited. Good for quick command-line transfers but less convenient for graphical clients.
Most users prefer SFTP over SCP because the experience is friendlier.
Rsync
Rsync is a synchronization tool that can run over SSH. It is more powerful than SFTP for keeping directories in sync, including only the differences between local and remote.
For developers managing static sites or large file collections, rsync is a useful tool. For basic file transfers, SFTP is enough.
Git-Based Deployment
Modern development workflows often skip direct file transfer entirely. You push code to a Git repository. The hosting platform pulls from Git when changes appear.
This approach has many advantages over manual file transfer. Version control, easy rollback, automated deployments, audit trails. For development teams, it is the modern standard.
Putting File Transfer Security in Place
The decision between FTP and SFTP is straightforward. SFTP is secure. FTP is not. There is no reason to use FTP for any modern website work.
The transition is easy. Most FTP clients support SFTP. Your host almost certainly supports SFTP. The connection settings are similar. The workflow is the same.
If you have been using FTP, switching to SFTP takes a few minutes. Change the protocol selection in your client. Update the port if needed. Use the same credentials. The transfers continue working as before, just encrypted.
For development teams, the right modern approach is to move away from manual file transfer entirely. Use Git-based deployment, deployment pipelines, or proper development workflows. SFTP becomes a backup tool for occasional manual work rather than the primary deployment method.
But even with modern workflows, you sometimes need to upload a file directly to a server. When that happens, use SFTP. The security cost of FTP is real. The setup cost of SFTP is minimal. There is no scenario where FTP makes sense over SFTP for a modern website. If your current workflow still uses FTP, fixing that should be one of the easier security improvements you make this month.
