Use FileZilla SFTP on Windows with Verified Server Identity

FileZilla Client can upload and download website files over SFTP when the server and account provide SSH-based file transfer. SFTP is not FTP over TLS, and entering port 22 into an FTP connection is not a reliable substitute for selecting SFTP.

Install the official client

Start at the FileZilla project and choose Client, not Server. Use the supported installer for your Windows version and architecture. Read installer choices and the publisher’s download information; do not simply install the first search result. Organization-managed computers may require administrator approval.

Save an SFTP connection

1. Open File > Site Manager and create a site with a recognizable name.
2. Choose SFTP – SSH File Transfer Protocol. Supply the actual SSH/SFTP host and port from the account settings; 22 is common, not guaranteed.
3. Choose the authentication type your server permits and enter the account username. Use its authorized key or password as applicable. Prefer prompting for a password over storing it on a shared computer.
4. Connect and compare the server’s SSH host-key fingerprint with the administrator’s independently supplied value before trusting it. Stop if the value is unexpected or changes without explanation.

If the hosting service offers FTPS instead, create a separate FTP/TLS profile with encryption required and a valid server certificate. Do not fall back to plain FTP to work around an SFTP login failure. Shared hosting FTP accounts may not have SSH/SFTP permission.

Transfer and verify files

The local and remote directory panes represent different computers. Select the local file, navigate to the correct remote destination, then upload it. For downloads, select the remote file and choose the intended local directory. Review the queued, failed and successful transfer tabs rather than assuming a whole folder finished because one file did.

Check overwrite behavior before transferring into a live site. Preserve a recovery copy elsewhere, use byte-preserving transfer for archives and images, and avoid publishing SQL exports or secrets. A successful directory listing proves neither write permission nor the correct website root. Test a harmless file at the intended URL and remove only that file afterward.

Connection problems

• Timeout: check the supplied host, custom port, service availability and narrowly scoped network rules.
• Authentication refused: confirm the account’s SSH entitlement, offered key and server-side authorization. Do not enable root or blanket password access.
• Permission denied after login: choose an authorized directory; do not recursively loosen website permissions.
• Host-key warning: verify through the administrator. Clearing a warning without checking does not establish identity.

References: FileZilla project and documentation and OpenSSH SFTP protocol client manual. Layout labels can vary with the installed client version.

Reviewed October 15, 2026. No FileZilla Windows walkthrough or customer-account connection was performed.