FTP has been the standard way to move files onto a web server for a very long time. Plenty of hosting accounts still offer it by default. Many site owners keep using it simply because it was set up that way years ago.
The problem is that plain FTP was never built with privacy in mind. Your files and your login travel across the internet in a form anyone in the path can read. Moving to SFTP or FTP over TLS fixes that, and the change usually takes only a few minutes.
What plain FTP actually sends
FTP stands for File Transfer Protocol. It connects your computer to the server and copies files in either direction. The catch is in how it does that. Columbia University’s guide to secure file transfer states that files uploaded and downloaded with FTP are not encrypted.
That covers more than your theme files and images. The same guide notes it also includes the password you use to connect to the server. Anyone who intercepts the traffic can read it. On public wifi in a cafe or airport, that is a real exposure.
A stolen FTP password is a serious matter for a website. It gives direct write access to the files that make up the site. Someone holding it can add hidden scripts or swap pages without ever touching your admin screen. Database attacks such as SQL injection get plenty of attention, but a leaked file login can do similar damage with far less effort.
SFTP and FTP over TLS are different things
Two options replace plain FTP, and their names cause a lot of confusion. They solve the same problem in different ways. Your host may support one, the other or both. It helps to know which is which before you change any settings.
SFTP
SFTP is the SSH File Transfer Protocol. Despite the name, it is not FTP with a security layer added. It is a separate protocol that runs inside an SSH connection. The working draft from the Internet Engineering Task Force says it assumes a secure channel such as SSH and that the server has already authenticated the client.
In practice this means the SSH connection does the heavy lifting. Your login and every file are carried inside that encrypted channel. The University of Michigan’s SSH and SFTP article describes SSH and SFTP as secure alternatives to telnet and FTP. It adds that they transmit your username and password in an encrypted form that is not easily intercepted.
FTP over TLS
FTP over TLS, often called FTPS, keeps the familiar FTP protocol but wraps it in encryption. It is the same family of security used by HTTPS websites. Columbia’s guide sets this up in FileZilla by choosing FTP and then requiring explicit or implicit FTP over TLS. The guide notes that a certificate prompt on first connection indicates the connection will be encrypted.
Both options protect your password in transit. SFTP tends to be simpler through firewalls because everything runs over one connection. FTPS can suit hosts that have not enabled SSH access for your account. Check your host’s help pages to see which one they offer on your plan.
How to make the change
Most popular file transfer programs already support SFTP and FTPS. You rarely need new software. The change is usually a matter of editing the saved site entry in your client. A few basic steps cover most setups.
- Look in your hosting control panel for SFTP or SSH access and switch it on if needed
- Change the protocol in your file transfer program from FTP to SFTP or to FTP over TLS
- Check the host name your provider lists, as it can differ from the one used for plain FTP
- Accept the server key or certificate on first connection only after confirming it belongs to your host
- Delete the old plain FTP entry so nobody connects the insecure way by habit
The type of hosting you use affects what is on offer. Some shared plans provide FTPS by default and offer SSH only on request. A virtual private server or dedicated server usually includes SSH access. Our guide to the types of web hosting covers how those plans differ.
Tidy up your file transfer accounts
Encryption protects the login while it travels. It does nothing if the password itself is weak or shared around. Many sites end up with a pile of old accounts created for past developers and contractors. Each one is another way in.
Give every person their own account rather than sharing one master login. Limit each account to the folder it needs where your host allows it. Remove access as soon as a project ends. A designer building a custom web design may need full access for a few weeks, but not for years afterwards.
Long, random passwords stored in a password manager are a sensible baseline. If your host supports SSH keys for SFTP, they remove the need to type a password at all. Keep the private key on your own device and never email it. If a laptop is lost or a staff member leaves, remove their key from the server straight away.
Good habits once you have switched
After the change, test the connection with a small upload before doing real work. Confirm the file appears where you expect on the live site. Then check that plain FTP is actually off. Some hosts leave the old service running unless you disable it.
Keep file transfers for the jobs that really need them. Theme edits, image uploads and plugin fixes are typical examples. Resize images to a sensible size before they go up, as heavy files are a common cause of slow pages. Our article on faster websites and better SEO goes through that side of things.
Some institutions have stopped allowing plain FTP altogether. University College London’s phonetics department, for example, states that insecure FTP is no longer available on its server. It accepts only secure clients for these transfers. That is a good model for any business website as well.
Frequently asked questions
Is SFTP just FTP with a password?
No. SFTP is a separate protocol that runs inside an encrypted SSH connection. Plain FTP has a password too, but sends it unencrypted. The names are similar while the security is very different.
Do I need new software to use SFTP?
Usually not. Most common file transfer programs support SFTP and FTP over TLS already. You normally just change the protocol setting on your saved connection. Your host provides the details you need.
Which is better, SFTP or FTPS?
Both encrypt your login and files in transit. SFTP is often easier to run through firewalls and supports key based logins. FTPS can be the practical choice when your plan does not include SSH access. Use whichever your host supports well.
Will switching break my website?
No. The protocol only changes how files travel between your computer and the server. The files themselves and the live site stay exactly the same. It is still wise to test with a small upload first.