FTP, FTPS and SFTP: Choose the Right Website Transfer Protocol

FTP, FTPS and SFTP can all move website files, but they are not interchangeable. Use the encrypted protocol your hosting account actually supports, with the server name, port and credentials supplied for that service. A web-hosting FTP account does not automatically have SSH or SFTP access.

Choose the right protocol

Protocol	Protection and connection	What to check
FTP	Ordinary FTP does not encrypt credentials or file contents. It uses separate control and data connections.	Do not use plain FTP for sensitive transfers over an untrusted network.
Explicit FTPS	FTP upgraded to TLS, commonly starting on port 21. Data connections also need protection.	Select a setting that requires TLS, validate the certificate, and require encrypted data transfers rather than allowing a plaintext fallback.
Implicit FTPS	TLS begins immediately, commonly on port 990; separate data connections still apply.	Use only if the server explicitly supports this mode.
SFTP	A file-transfer protocol carried over SSH, commonly on port 22. It is not FTP with TLS.	Confirm SSH/SFTP entitlement and verify the server’s SSH host-key fingerprint.

Ports can be customized; a port number alone does not establish which protocol is running. FTPS normally authenticates the server using a certificate and the user using account credentials. Client certificates are an optional deployment choice, not a requirement of every FTPS connection. Do not enable obsolete ciphers to make an old client connect.

Why FTP logins can work while directory listings fail

FTP has a control connection for commands and a separate data connection for listings and transfers. In passive mode the client connects to a server-selected data port. An incorrect advertised address, blocked passive range, NAT mapping or TLS data-channel policy can therefore break listings after a successful login. In active mode the server initiates the data connection to the client, which can encounter client-side firewall restrictions. Do not disable firewalls globally to diagnose either case.

Connect and transfer safely

1. Get the exact protocol, host, port, account and permitted remote directory from your hosting settings. Do not assume a domain’s web address is also its transfer endpoint.
2. Use a maintained client such as WinSCP, FileZilla or Cyberduck from its official publisher. Select the protocol explicitly.
3. Compare a new SSH fingerprint through a trusted separate channel, or validate the FTPS certificate name and chain. Stop on an unexpected change rather than accepting it automatically.
4. Upload a harmless test file to the permitted directory. Confirm its contents and remove only that test file. Preserve a copy before overwriting a live website file.
5. For archives and other byte-sensitive files, avoid text-mode newline conversion. Restrict saved credentials and revoke access when no longer needed.

Encryption protects a correctly authenticated connection in transit; it does not make compromised clients, stolen keys, permissive accounts or malicious uploaded code safe. A successful transfer is also not a complete website backup: databases, mail and configuration may live elsewhere.

References: FTP with TLS specification, OpenSSH SFTP manual and WinSCP host-key verification.

Reviewed October 15, 2026. Protocol guidance; no account entitlement or customer transfer was tested.