FTP/SFTP

FTP moves files to and from a hosting server over port 21. SFTP moves the same files over SSH on port 22. The difference is not speed, it is how the credentials travel. Plain FTP sends your username and password in clear text; SFTP wraps the whole session in SSH encryption.

Credentials decide the risk

On ordinary FTP, the login and the file contents run unencrypted, so anyone who can tap the network reads them. SFTP has no such gap and usually uses key authentication: you place a public key on the server, and the client proves it holds the matching private key, which is never sent. The number of FTP accounts a plan allows varies by provider, so check your plan specs rather than trusting a fixed number. Many older FTP setups also have no built-in TLS, so even explicit mode is not always available.

Passive mode and the firewall

FTP uses two connections: a command connection on port 21 and a separate data connection. In active mode the server opens the data connection, which often stalls behind NAT. Passive mode flips it so the client opens the data connection to an ephemeral port, which behaves better behind firewalls. If the server runs its own firewall, that data port range must be allowed; see Linux Firewall.

When the connection times out

A "connection timed out" here is rarely a wrong password. A wrong password produces a clear authentication refusal. A timeout is almost always a path problem: port 21 blocked by the network, the transfer mode not set to passive, or your IP not allowed. Switch the client to passive mode first, then connect over SSH to confirm the address and port are correct.

Which one to use

A limited FTP account is handy for giving a designer access to a single folder, created in cPanel. SFTP over SSH gives broader, safer access for development work. For moving hundreds of files, FTP is the wrong tool, rsync over SSH is far more efficient. The host can be a domain name or the server IP address. For a large move between hosts, read hosting migration. For automated jobs such as cron, key-based SFTP is more reliable because no password has to sit in the script.

FAQ