Secure FTP for Web Hosting: What You Need

Secure FTP for web hosting means using a protocol that encrypts your login credentials and file transfers, so hackers can’t intercept them. The two main options are FTPS (FTP over SSL/TLS) and SFTP (SSH File Transfer Protocol), and you should use one of them instead of plain FTP. This article explains how each works, how to set them up, and how to choose the right one for your hosting account.

Background: Why Plain FTP Is Dangerous

FTP (File Transfer Protocol) was designed in the 1970s, long before security was a concern. It sends your username and password in plain text, meaning anyone on the same network can read them with a packet sniffer. On public Wi-Fi, that’s a real risk. Once someone has your FTP credentials, they can upload malicious files to your website, deface it, or steal data. Most web hosts now offer secure alternatives, and many have disabled plain FTP entirely.

How FTPS Works

FTPS is the direct upgrade to FTP. It wraps the original FTP protocol in a layer of SSL/TLS encryption, the same technology that secures HTTPS websites. When you connect, the server presents a certificate, and your client verifies it. Then all commands and data transfers are encrypted.

There are two modes:

• Explicit FTPS (FTPES): The client connects on the standard FTP port 21, then sends an AUTH TLS command to switch to encryption. This is the more common and recommended mode.
• Implicit FTPS: The client connects directly to a dedicated port (usually 990) and encryption starts immediately. This mode is considered deprecated but still supported by some hosts.

FTPS uses the same commands and folder structure as FTP, so it’s easy to migrate. However, it can be tricky with firewalls because it uses multiple ports: one for commands and another for data. Passive mode (PASV) helps, but your host must allow the data port range.

How SFTP Works

SFTP is not FTP at all. It’s a file transfer subsystem that runs over SSH (Secure Shell), usually on port 22. SSH is the same protocol used for secure command-line access to servers. SFTP encrypts everything, including authentication and data, and it uses a single connection, which makes firewall configuration simpler.

Because SFTP is built on SSH, it often uses the same credentials as your SSH login. Some hosts require you to enable SSH access before SFTP works. SFTP also supports public key authentication, which is more secure than passwords alone.

How to Choose Between FTPS and SFTP

Your choice depends on what your web host supports. Most shared hosting providers offer both, but some only offer one. Here’s a quick comparison:

• FTPS: Works with any FTP client (FileZilla, WinSCP, Cyberduck). Good if you need to connect to many servers that don’t support SSH. Certificate validation can be confusing for beginners.
• SFTP: More secure because it uses SSH keys, and it’s firewall-friendly. If your host gives you SSH access, SFTP is usually the better choice.

If your host only offers plain FTP, you should ask if they support FTPS or SFTP. If they don’t, consider switching hosts, because plain FTP is a serious security risk.

How to Set Up a Secure Connection

Setting up either protocol is straightforward. Here are the steps for a typical FTP client like FileZilla:

1. Open your FTP client and go to Site Manager.
2. Choose a protocol: select “FTPS – FTP over TLS” or “SFTP – SSH File Transfer Protocol”.
3. Enter your hostname, username, and password. For SFTP, the port is usually 22; for FTPS, it’s usually 21 (explicit) or 990 (implicit).
4. For FTPS, set the encryption to “Require explicit FTP over TLS” if available.
5. Connect. Your client will show a certificate warning the first time—verify it matches your host’s domain.

If you get a “connection refused” error, check the port and make sure your host has the service enabled. Some hosts have a separate SFTP port for shared plans.

Common Problems and Solutions

Here are issues you might encounter and how to fix them:

• Certificate warnings: If the certificate is self-signed or doesn’t match the hostname, your client will warn you. Verify the fingerprint with your host before accepting it.
• FTPS connection times out: Usually a firewall issue. Try passive mode and ensure your client is configured to use the passive port range your host specifies.
• SFTP says “server refused to start subsystem”: The SSH server may not have SFTP enabled. Contact your host.
• Password not accepted: For SFTP, you may need to use your SSH password, which could be different from your control panel password.

Costs and Alternatives

Both FTPS and SFTP are free to use—they’re built into most FTP clients. The only cost is if your host charges extra for SSH access (for SFTP), which is rare on modern shared hosting. Alternatives to FTP/SFTP include:

• Web-based file managers: cPanel or Plesk file managers work over HTTPS, so they’re encrypted. Good for occasional changes.
• rsync over SSH: Great for syncing large directories, but more technical.
• Git deployment: If you’re a developer, you can push code via Git over SSH, which is secure and version-controlled.

Frequently Asked Questions

Is SFTP the same as FTPS?

No. SFTP runs over SSH and uses a single connection on port 22. FTPS is FTP over SSL/TLS and uses multiple ports. They are incompatible, so you can’t use an SFTP client to connect to an FTPS server and vice versa.

Do I need a VPN to use secure FTP?

No. FTPS and SFTP already encrypt your data, so a VPN is unnecessary for the transfer itself. However, a VPN adds an extra layer if you’re on an untrusted network, but it’s not required.

Can I use the same FTP client for both FTPS and SFTP?

Yes. Most modern clients like FileZilla, WinSCP, and Cyberduck support both protocols. You just select the protocol in the connection settings.

Why does my host only offer plain FTP?

Some older or budget hosts haven’t implemented secure options. This is a red flag. You should insist on FTPS or SFTP, or move to a host that offers them.

What port does SFTP use?

SFTP typically uses port 22, the same as SSH. Some hosts use a different port for security, so check your welcome email or control panel.

Is FTPS safe on public Wi-Fi?

Yes, because the connection is encrypted. However, you should still verify the server certificate to avoid man-in-the-middle attacks.

Related

• Snapdragon 865 vs Dimensity: Which Chip Wins?
• Kobold Harvest Laborer? Role & Reality
• iPod Won’t Turn On? Fixes for Every Model