SFTP instead of FTP: when you can, and why it is better

Three similar names, three different things, and the confusion between them fills our support queue. Worth sorting out first, because everything after it becomes easy.

Name	What it is
FTP	The old protocol. Sends everything in the clear, password included. Never use it on its own.
FTPS	The same FTP with a layer of encryption over it. This is what FileZilla calls explicit FTP over TLS, and it is safe. It still uses two connections and still needs passive mode.
SFTP	Not FTP at all, despite the name. It is file transfer inside SSH. One connection, everything encrypted, and none of FTP’s port trouble.

Why SFTP gives you less grief

1	One connection. FTP opens one for commands and another for data, and it is the second one office networks block. Hence the classic «it connects but shows no files». With SFTP that problem simply does not exist.

2	No passive mode, no port ranges. There is nothing to configure on the network, which makes it the right choice on corporate networks, in hotels, and behind firewalls you do not control.

3	Encrypted, always. There is no option to accidentally switch it off, which is exactly what happens with FTP.

4	You can use keys instead of a password. A key cannot be guessed and cannot be mistyped.

The fields, in FileZilla

In the Site Manager, create a new entry and change three things compared with FTP.

Field	What to put in it
Protocol	SFTP, from the list.
Host	The server name we gave you. It does not take ftp. in front.
Port	2299. The SSH port here is not 22, and leaving the field blank makes FileZilla try 22 and fail.
User	Your cPanel user, not an FTP account. Read the next point before deciding.
Password	The cPanel one, or a key.

On the first connection you get the server fingerprint. That is normal. Accept and save it; if it turns up again another day for no reason, stop and talk to us.

This is the trade you have to make with your eyes open. An FTP account can be locked to one folder: hand it to a developer and that is all they see. An SFTP login comes in as the cPanel user and sees the whole account: every site, the mail, everything. For you, working alone, SFTP is better in every way. For giving somebody else access to one site, a restricted FTP account is still the right answer.

Does your account have SSH switched on?

SFTP runs inside SSH, and every plan has SSH. You can confirm it like this:

1	*Look for Terminal* or SSH Access in cPanel.** Both are there on every plan.

2	To test it, connect over SFTP on port 2299. An immediate «permission denied» usually means the user, password or key is wrong; a timeout usually means your own network.

3	Ask us. If it does not connect, we will go through it with you. Meanwhile, use FTP over TLS, which is perfectly safe.

Keys instead of a password

One extra step the first time and one less nuisance forever. In cPanel, under SSH Access, there is key management: generate a pair, authorise the public one, keep the private one on your computer. Then in FileZilla settings, in the SFTP section, add the key file, and the program logs in without asking anything.

The private key is your identity. Treat it like the password: do not e-mail it, do not put it in a repository, and give it a passphrase when you generate it.

Still need FTP accounts for other people? The walkthrough is in FTP accounts and connecting with FileZilla, and what goes wrong is in common FTP errors.

Want help getting SSH working with keys? Ask us.

Open a support ticket

In our plans

SFTP needs SSH, and every shared hosting plan includes SSH access and the Terminal in cPanel, so there is no plan to upgrade to and nothing to ask us to switch on beforehand. To check on your own account, look for Terminal or SSH Access in cPanel. If neither appears, or the login is refused, open a ticket and we will look at the account. Remember that SFTP enters as the cPanel user and sees everything. FTP accounts are unlimited in every plan, so for each person who only needs one site you can create a separate, restricted FTP account.

Categories

Categories