FTP vs SFTP
Use SFTP, not FTP, whenever the host offers SSH. FTP sends the username, password and file bytes in cleartext on port 21 plus a second data port. SFTP wraps the same job inside one encrypted SSH session on port 22. On WebJi® cPanel hosting the panel username logs in over SFTP on that port.
For Indian site owners and developers choosing how to upload sites, pull backups and hand off files safely.
knowledge
- Read time
- 5 min
- Sections
- 8
- Updated
- 14 Nov 2026
- Written by
- WebJi® team
Last editorial update: 15 November 2026.
What is the difference between FTP, SFTP and FTPS?
FTP, SFTP and FTPS are three separate protocols, not three settings of one: SFTP is a file-transfer subsystem inside SSH, FTPS is old FTP wrapped in TLS, and plain FTP has no encryption at all. The shared letters cause the mix-up — SFTP is not "secured FTP", and a client set to FTPS will never talk to an SFTP-only server.
| Dimension | FTP | SFTP | FTPS |
|---|---|---|---|
| Encryption | None | SSH, always | TLS |
| Ports | 21 + data range | 22 only | 990, or 21 + range |
| Credentials in transit | Cleartext | Encrypted | Encrypted |
| Authentication | User and password | Password or SSH key | Certificate plus password |
| Transport | Two TCP channels | One SSH session | FTP plus TLS |
| Firewall-friendliness | Poor | Excellent | Fiddly |
| Verdict | Avoid on the public internet | Default choice | Only when SSH is impossible |
TFTP is a fourth thing entirely — a UDP tool for booting routers and switches, never a way to publish a website.
How do FTP and SFTP actually move a file?
FTP opens a command connection on TCP port 21 and then a second TCP connection just for the file; SFTP opens one SSH session on TCP port 22 and carries listings, uploads and deletes as packets inside it.
FTP's second channel is where the trouble lives. In active mode the server calls the client back — something client-side firewalls and NAT refuse. In passive mode the client opens a high port that the server names, so the server must keep a whole range of ports open. Either way, the password and the file bytes travel unencrypted.
SFTP never opens that second connection. The client starts SSH on port 22, checks the server's host key, authenticates with a password or key, and requests the SFTP subsystem. One connection in, one connection out.
Why is plain FTP unsafe for a website upload?
Plain FTP is unsafe because anyone listening on the network path can read the username, the password and the file itself — and a stolen hosting password is a compromised website. SFTP encrypts all three, and the host-key check rejects a server that is not the one you connected to last time.
- Exposed login: the password crosses the wire in cleartext, readable on shared Wi-Fi or a compromised hop.
- Exposed files: a site backup, mailbox export or customer list is visible in transit.
- Firewall fights: active mode asks the server to connect outward to you; passive mode needs a pinhole range.
- Browsers agreed: Chrome and Firefox removed their built-in FTP clients — that is how finished the protocol is.
Keep port 21 for a throwaway file on a network you physically control, never for anything that touches a real site.
How do you connect with FileZilla over SFTP?
In FileZilla, choose SFTP as the protocol and port 22, then log in with the hosting username and password — on a cPanel account, that is the cPanel username and panel password.
- Install FileZilla, then open File → Site Manager → New Site.
- Set Protocol to SFTP - SSH File Transfer Protocol, Host to the domain or server IP, Port to 22, Logon Type to Normal. Choose Key file only if you were issued an SSH key.
- Connect and accept the host-key prompt the first time — that is SSH confirming the server, not a failed login.
- Drag files from the left pane to the right pane; for a website, open the remote
public_htmlfolder first.
A 530 authentication failed message means the username or password does not match; connection refused on port 22 means something on the path blocks SSH — try the server IP from the welcome mail before you give up. Where files belong, including public_html, is covered in uploading a website via FTP client.
What port and firewall differences matter — and which is faster?
SFTP needs one inbound TCP port (22); FTP needs port 21 plus a passive data range, which is exactly why it stalls behind home routers and office firewalls. Explicit FTPS keeps port 21 plus that range, implicit FTPS uses 990 plus the range.
- If FTPS must stay: pin the passive range to something small, such as 30000–31000, and open only those ports.
- SSH not on 22: the port each protocol uses, and how to handle a moved SSH port, is in the SFTP port number guide; cPanel can also restrict SSH/SFTP logins to your IP.
- Speed: FTP skips the cipher so a lab test can show it marginally ahead, but on a real upload disk speed and the link dominate. What actually feels slow is FTP opening a new data connection per file, or a dropped passive port — one SFTP session or one compressed archive avoids both. Choose SFTP for the hidden login, not a speed ranking.
- Many small files: pack the site into one archive before sending; thousands of tiny files spend more time opening connections than moving bytes.
SCP, SFTP or plain SSH — which for which job?
SCP copies one file or folder in a single command and exits; SFTP stays open so you can list, resume, rename and delete; SSH is the encrypted login underneath both. None of them is FTP.
- One archive, one shot:
scp site.tar.gz user@host:~/style copy — see the SCP command guide. - Browsing the account: an SFTP session, or your client's SFTP mode.
- Current OpenSSH note: modern
scpitself runs over the SFTP subsystem, so both take the same key or password on port 22.
Which should you use on a cPanel account?
Use SFTP for site uploads, backup downloads and theme files; FTPS only when the other side cannot speak SSH and demands TLS; plain FTP only for a disposable file on a network you control. On cPanel accounts at WebJi®, the panel username logs in over SFTP on port 22.
For a single-file edit, the File Manager inside the panel is faster than opening any client — see the cPanel File Manager guide. If you are weighing control panels themselves, read cPanel vs DirectAdmin; if you need the account first, cPanel hosting at WebJi® — a separate product from the Linux shared plans — lists at ₹297 a month before 18% GST. Questions before ordering go to support@webji.services, staffed 24/7 in Hindi and English.
Frequently asked questions
Is SFTP more secure than FTP?
Yes. SFTP encrypts the password, the commands and the file bytes, and checks the server host key before sending anything. FTP exposes all of that in cleartext, so anyone on the network path can read the login and take the account over.
Is port 22 used for FTP or SFTP?
Port 22 is SSH and SFTP. Port 21 is FTP. FTPS starts on 21 in explicit mode or 990 in implicit mode. A client pointed at port 22 with the FTP protocol selected will not log in, because the server there speaks SSH, not FTP.
Why is plain FTP being phased out?
The password and files are visible on the network, and the second data channel is awkward behind firewalls. Browsers removed their built-in FTP clients for these reasons. SFTP does the same job on one port without exposing the login.
Does SFTP use TCP or UDP?
TCP. SFTP runs over SSH, and SSH uses TCP port 22. It does not use UDP — that is TFTP, a different tool for booting network devices. If a firewall blocks outbound TCP 22, the SFTP session never starts.
Do I still need FTP if I have cPanel?
No. Use SFTP with the cPanel username on port 22, or edit one file directly in File Manager. Plain FTP is not required to publish a site, and an open port 21 only adds a cleartext login path to the server.
Last editorial update: 15 November 2026. Prices follow the dated sources on this page; checkout confirms current charges.
Ready to get started with WebJi®?
Join 12,000+ businesses across India and overseas. INR pricing, 18% GST shown before payment and 24/7 email support in Hindi and English — average first reply under 60 minutes.