Securing Your FTP Transfers with SFTP
Learn how to secure file transfers with SFTP or FTPS: encryption, strong logins, SSH keys, restricted accounts, and clients such as FileZilla, WinSCP, or Cyberduck.
Why not plain FTP?
FTP sends the password and the files in clear text. SFTP runs over SSH (usually port 22) and encrypts both. FTPS is FTP plus TLS on port 21 plus data ports. Prefer SFTP when SSH is enabled. FTP vs SFTP vs FTPS
SFTP
One port, SSH auth or keys, works well on cPanel. Use the main hosting username unless the host documents extra SFTP users.
FTPS
Use this for extra cPanel FTP accounts. Those logins are not SFTP by default.
Creating an extra FTP account in cPanel does not create SFTP access. SFTP needs SSH. Using SFTP with cPanel
Turn on SSH / SFTP
- cPanel → Security → SSH Access. Confirm the host allows it and note the port (22 or a custom port).
- Optional: Manage SSH Keys → generate, authorize the public key, keep the private key at mode 600.
- In the client choose protocol SFTP, the same host, the SSH username, and port 22 (or the custom port).
- Accept the host key only if it matches what you expect.
Client settings
Account hygiene
- Jail extra FTP accounts to one folder. FTP user accounts
- Do not save passwords on a shared PC.
- Disable anonymous FTP if the host exposes it.
- Drop unused keys and unused FTP logins.
If SFTP will not connect
| Issue | What to try |
|---|---|
| Connection refused | SSH may be off, or the port is not 22. Connection troubleshooting |
| Auth failed | Use the SSH username, not an extra FTP user. Check key permissions. |
| Need extra people on SFTP | Ask the host; cPanel extra FTP accounts stay on FTP/FTPS. |
Frequently Asked Questions
Why is standard FTP considered unsafe?
FTP sends the username, password, and file contents in plain text. Anyone on the same network path can capture that traffic. Use SFTP when SSH is enabled, or explicit FTPS when you are connecting with a regular cPanel FTP account. Save the encrypted protocol in your client’s Site Manager so later sessions do not fall back to plain FTP. Background reading: what FTP is.
Should I use an SSH key instead of an SFTP password?
A key pair is stronger for frequent or automated SFTP logins. Generate the key in cPanel under Security → SSH Access → Manage SSH Keys, authorize the public key, and point FileZilla or WinSCP at the private key. Protect that file with tight permissions and an optional passphrase. Passwords still work, but a unique key is easier to revoke if a laptop is lost. Setup steps are in using SFTP with cPanel.
What if my hosting plan does not allow SSH?
Then SFTP will not connect, even if the client is set to port 22. Use explicit FTPS for extra FTP accounts created in cPanel, restrict each login to one folder, and turn off anonymous FTP. Ask the host whether SSH can be enabled for the primary account. Protocol differences are summarized in FTP vs SFTP vs FTPS.
Can a separately created FTP account use SFTP?
Usually no. Extra cPanel FTP users are made for FTP or FTPS and do not automatically receive SSH. SFTP typically uses the primary cPanel username or another SSH-enabled system account. If SFTP fails with name@yourdomain.com, switch that saved site to FTP with TLS. Create limited logins with an FTP account in cPanel so vendors never need the main password.
Should I accept the SFTP host key warning?
Accept it only when you trust the hostname or IP from your host. The first prompt stores the server’s key so later changes stand out. If the warning appears again on a server you already use, stop and confirm the address with the provider before you continue. A changed key can mean a different machine is answering. Compare clients in choosing an FTP client.
Does disabling anonymous FTP still matter?
Yes. Anonymous FTP lets people connect without your account password and should stay off unless you have a rare public-download need. Also remove unused extra FTP accounts and watch FTP Connections for sessions you do not recognize. Encryption protects data in transit; unused logins are a separate risk. Password guidance is in creating a strong password.
Is FTPS secure enough if I cannot use SFTP?
Yes, when the client requires TLS and you verify the certificate. FTPS encrypts the login and files with SSL/TLS. It is the practical choice for extra cPanel FTP users. Use Passive mode if directory listings fail through a firewall. Prefer the server hostname from cPanel if a certificate name warning appears. Encryption terms are explained in encryption basics.
Where should I store SFTP private keys and site passwords?
Keep the private key off the web root and off shared computers. On Linux or macOS, store it under ~/.ssh with restricted permissions. Let the client use the OS keychain when it offers one, and never place keys or passwords inside a public website folder. Delete saved site profiles from a machine you no longer use. More hosting and security articles are on the blog index.
Related FTP Tutorials and How To Guides
Tweet Share Pin Email
Add Comment
This policy contains information about your privacy. By posting, you are declaring that you understand this policy:
- Your name, rating, website address, town, country, state and comment will be publicly displayed if entered.
- Aside from the data entered into these form fields, other stored data about your comment will include:
- Your IP address (not displayed)
- The time/date of your submission (displayed)
- Your email address will not be shared. It is collected for only two reasons:
- Administrative purposes, should a need to contact you arise.
- To inform you of new comments, should you subscribe to receive notifications.
- A cookie may be set on your computer. This is used to remember your inputs. It will expire by itself.
This policy is subject to change at any time and without notice.
These terms and conditions contain rules about posting comments. By submitting a comment, you agree with these rules:
- Although the administrator will attempt to moderate comments, not all comments can be moderated at all times.
- You acknowledge that all comments express the opinions of the original author and not those of the administrator.
- You will not post material which is knowingly false, obscene, hateful, threatening, harassing or invasive of privacy.
- The administrator has the right to edit, move or remove any comment for any reason and without notice.
Failure to comply with these rules may result in being banned from submitting further comments.
These terms and conditions are subject to change at any time and without notice.
What is SSI? How To Use Server Side Includes
What Is Softaculous. The Best Automatic Script Installer
What is the Difference Between Magento and PrestaShop
What are The Best Self-Hosted Forums Programs, Scripts or Apps?
Comments