FTP vs SFTP: how to upload files to your hosting safely

Sooner or later, almost every website owner needs to move files to and from their hosting account: a theme update, a batch of product images, a backup you want to download before making changes. The two most common ways to do that are FTP and SFTP, and while their names look almost identical, the difference between them matters a lot more than one extra letter suggests. Picking the right one affects not just convenience, but the actual security of your site and your hosting account.

What is FTP, and why is it still used?

FTP, or File Transfer Protocol, is one of the oldest ways to move files over a network, dating back decades before the modern web. It works by opening a connection between an FTP client on your computer and an FTP server on your hosting account, then letting you browse remote folders and drag files back and forth much like a local file manager. FTP is still around today because it’s simple, fast, and supported by virtually every hosting control panel and client application. The catch is that classic FTP was designed in an era before encryption was standard, so by default it sends your username, password and files as plain, unencrypted text.

What makes SFTP different (and safer)

SFTP, or SSH File Transfer Protocol, looks similar on the surface — same folders, same drag-and-drop workflow in most clients — but it runs entirely inside an encrypted SSH connection. That means your login credentials and every file you transfer are protected from anyone who might be listening on the network, whether that’s a shared Wi-Fi hotspot or a compromised router somewhere between you and the server. Because SFTP piggybacks on SSH, it also benefits from the same key-based authentication options, so you can set up file transfers that don’t rely on a password at all. For any hosting account handling real traffic or customer data, SFTP is the safer default.

FTP vs SFTP: the key differences at a glance

The practical differences come down to three things: encryption, the port used, and authentication. FTP transmits everything unencrypted and typically uses port 21, while SFTP encrypts the whole session and runs over port 22, the same port used for SSH. FTP generally only supports username-and-password logins, while SFTP also supports SSH keys. Speed-wise, the two are close enough in practice that it rarely matters — the real-world bottleneck is almost always your internet connection, not the protocol. Given how similar they are to use, there’s little reason to choose plain FTP once SFTP is available on your hosting account.

Setting up an FTP/SFTP connection to your hosting

Most hosting control panels let you create an FTP or SFTP account in a few clicks, giving you a hostname, username, password and port to plug into a client such as FileZilla, Cyberduck or WinSCP. If your provider offers both, look for the SFTP option — the connection details are nearly identical, but the “protocol” dropdown in your client needs to be set to SFTP (often labelled “SSH File Transfer Protocol”) rather than plain FTP or FTPS. Once connected, you’ll see your website’s file structure exactly as it exists on the server, ready to upload, download or edit directly.

Best practices for safe file transfers

A few habits go a long way here: prefer SFTP over FTP whenever it’s available, use a unique, strong password or an SSH key rather than reusing credentials from elsewhere, and create separate FTP/SFTP accounts scoped to a single folder when you’re handing access to a developer or agency rather than sharing your main login. It’s also worth double-checking that your client isn’t configured to save passwords in plain text, and turning off anonymous FTP access entirely if your hosting control panel offers it, since it’s rarely needed and is an easy target for automated bots.

FTP and SFTP at Hostimul

Every cPanel Hosting plan at Hostimul includes unlimited FTP accounts with SFTP support out of the box, so you can choose whichever protocol fits your workflow. For larger projects or agencies managing multiple sites, our VPS and App Hosting plans give you full SSH and SFTP access alongside root-level control. If you’re not sure which account details to use, our support team can walk you through setting up your first secure connection.