FTP and SFTP: the file transfer protocol explained

FTP (File Transfer Protocol) and SFTP (SSH File Transfer Protocol) are two methods for moving files directly onto and off a web server. Developers use them to upload site files, install software, or retrieve backups, outside of a content management system’s own browser-based editor.

The difference that actually matters

FTP transmits data, including the username and password used to log in, without encryption. Anyone able to observe the network traffic on an unsecured connection can potentially read those credentials in plain text. SFTP encrypts the entire connection, including the login itself. It is the version that should be used for any account holding genuine access to a live website. A hosting provider or developer still offering plain FTP as the only option, in 2026, is offering a materially weaker security posture than one offering SFTP.

Where this shows up in a project

Most day-to-day content editing on a modern website happens through the content management system’s own admin screen, and never touches FTP or SFTP at all. File-level access matters specifically when installing software directly, retrieving a full backup, or troubleshooting at a level the CMS’s own editor does not reach. That is usually a developer’s task rather than a business owner’s. But the credentials themselves should still be something the business holds or can request, not something that exists only in a supplier’s own private records.

FTP and SFTP: the file transfer protocol and encryption layer underneath — SSH, TCP and ports

SFTP is not “FTP with a password”. It runs the file transfer entirely inside an SSH (Secure Shell) session, the same secure channel used for remote server administration, rather than as its own protocol layered over plain TCP. Plain FTP, by contrast, opens its own unencrypted connection on a distinct port — historically port 21 for commands, and a separate port for the data itself. That is part of why it is harder to firewall safely than a single SSH-based connection. A related protocol, FTPS, adds encryption to classic FTP instead of replacing it with SSH. It is a different mechanism, the same goal, and rarely offered by mainstream Australian hosts today. FTP, SFTP and FTPS are three protocols solving the same problem three different ways. That is why the names get confused with each other so often.

Why SFTP is called “secure file transfer”

SFTP is sometimes marketed as “secure file transfer” specifically because of the SSH-based encryption underneath it — the name describes what the protocol protects, not a separate feature bolted on top.

Where the security gap in unencrypted files, data and FTPS transfers shows up

An unencrypted FTP session exposes more than a password. The file itself, and any sensitive data transfers moving through the same channel, travel in plain text and can be read by anything sitting on the network path. That matters most for file transfers carrying customer records or payment-adjacent data. A merchant’s contractual security standard — PCI-DSS, for anything touching card data — expects encrypted transfers and real authentication, not a decades-old default. Known vulnerabilities in old FTP server software are still being exploited today, which is another reason to retire it rather than patch around it. A cloud back-up service that a developer chooses to integrate with a site’s file system carries the same exposure, if the sync itself runs over an unencrypted channel. This is worth checking rather than assuming — and not something that only matters when someone is transferring a large backup file once a year.

What to ask

Whether the site’s hosting account offers SFTP rather than only plain FTP, and whether the business itself holds a genuine copy of the login credentials rather than relying entirely on a supplier’s access.

A note on FTP clients

Connecting over FTP or SFTP normally happens through a dedicated FTP client application — FileZilla is a common free example — rather than a web browser. The client asks for a hostname, a username, a password (or an SSH key for SFTP), and a port number. Most mainstream hosts publish these connection details in their own control panel, under a heading such as “FTP accounts” or “SFTP/SSH access”. Confirming which of the two the host actually offers, before assuming a set of instructions written for one applies equally to the other, avoids a common source of confusion when a developer is handed access to a site for the first time.

What to do next

For where file-level access and technical build work generally sits in a project, web development services covers the service scope this fits inside.