What Is FTP and SFTP?

FTP (File Transfer Protocol) and SFTP (SSH File Transfer Protocol) are two ways to move files between your computer and the server that hosts your website. FTP is the original, defined in RFC 959 back in October 1985, and it sends everything in plain text. SFTP is a separate, encrypted protocol that runs over SSH. For any live business site, SFTP is the one to reach for.

How does FTP move a file?

FTP works by opening two connections between your computer and the server: one to send commands, one to carry the file itself. You log in with a username and password, then upload or download.

The catch is what happens to that login. Plain FTP sends your username, password, and files as readable text across the network. Anyone positioned between you and the server can read them.

MDN describes FTP as an insecure protocol for transferring files that is "no longer supported by many hosting accounts" (MDN). It has done its job since the 1980s, but it predates the encrypted web.

Its default command connection runs on port 21.

How is SFTP different from FTP?

SFTP is a different protocol from FTP, not a safer setting inside it. It runs over SSH, the same encrypted channel administrators use to log into servers, and it usually travels on port 22.

The ssh.com Academy puts it plainly: SFTP "runs over the SSH protocol" and inherits its encryption and authentication. Your login and your files are scrambled the whole way.

This is the point most guides get wrong. SFTP was built from the ground up on SSH. It is not "FTP with an S," and it is not the same as FTPS.

FTP vs FTPS vs SFTP

There are three names people mix up, and only two of them are related. FTPS is FTP with TLS encryption bolted on. SFTP is its own protocol on SSH.

	FTP	FTPS	SFTP
Full name	File Transfer Protocol	FTP over TLS/SSL	SSH File Transfer Protocol
Encryption	None, cleartext	FTP wrapped in TLS	Built in, over SSH
Usual port	21	21 (or 990)	22
Relationship	The original	An extension of FTP	A separate protocol

Source: RFC 959 and the ssh.com Academy SFTP guide, both linked above; verified November 2026.

FTPS keeps FTP's two-connection design and adds a TLS layer. SFTP uses its own operations, such as OPEN, READ, WRITE, and RENAME, defined for SSH rather than borrowed from FTP. Both encrypt, so either beats plain FTP, but they are not interchangeable in your settings.

Which should you use for your website?

Use SFTP whenever your host supports it. The ssh.com Academy says SFTP has "pretty much replaced legacy FTP".

It gives you one encrypted connection, is simpler to get through firewalls, and protects the credentials that control your whole site. It guards your file transfers the way SSL guards the traffic between your visitors and your pages.

Most hosts expose SFTP through the same cPanel or hosting account you already have, often the moment SSH is enabled. You connect with a client like FileZilla or WinSCP, the same way you would with old FTP. It works whether you are uploading to the live server or to a staging site first.

In our experience maintaining Malaysian SME websites, the riskiest logins are the ones nobody changed after handover. Old FTP credentials from a previous vendor often still work, still travel in the clear, and still sit in a saved connection somewhere.

Plain FTP is worth avoiding for anything that matters. If a host or tool only offers FTP, treat it as a reason to ask why, not a default to accept.

Frequently asked questions

Is SFTP the same as FTPS?

No, they are two different things that sound alike. FTPS is ordinary FTP with a TLS encryption layer added, keeping FTP's commands and its two-connection design. SFTP is a separate protocol built on SSH, with its own file operations. Both are encrypted and both are safer than plain FTP, but they are not the same protocol and are not configured the same way.

Is plain FTP still safe to use?

Usually not for a live site. Plain FTP sends your username, password, and files as readable text, so anyone on the network path can capture them. For uploading to a public web server you want SFTP or FTPS instead. The encrypted option is standard now and rarely harder to set up.

What port does SFTP use?

SFTP normally uses port 22, the same port as SSH, because SFTP runs inside an SSH connection. Plain FTP uses port 21 for its command channel, and implicit FTPS often uses 990. If you are filling in connection details and the protocol is SFTP, port 22 is the usual answer unless your host has changed it.

Do I need special software to use SFTP?

Yes, you use a file-transfer client, but the popular ones handle SFTP already. FileZilla, WinSCP, and Cyberduck all connect over SFTP by picking it from a dropdown and entering your host, username, and password or key. Many code editors can connect over SFTP too. You do not need anything different from what you would have used for FTP.

My host only offers FTP. Is that a problem?

It is a fair reason to ask questions. A host that cannot offer SFTP in 2026 is unusual, since SFTP usually comes with the server's SSH software. Check whether SSH access is available, because SFTP usually turns on with it. If encryption genuinely is not on offer, that tells you something about the host worth weighing before you move a site there.

Moving your files the safe way

Storming Solutions builds custom-coded websites for Malaysian businesses from Kuala Lumpur, maintains existing sites, and runs SEO, AEO, and GEO. Secure file access is part of a clean handover, not an afterthought. We think whoever holds the file access holds the site, so it should be you, over an encrypted connection.

Not sure who can reach your site files, or how? Message us about web development, or start with what web hosting actually is.