SFTP Port Number
SFTP uses TCP port 22 by default, the same port as SSH, because it runs inside the SSH connection. FTP uses 21, implicit FTPS 990 and HTTPS 443. In FileZilla, choose the SFTP protocol and keep port 22 unless your server's SSH was moved to a custom port such as 2222.
For developers and site owners connecting FileZilla, WinSCP or a terminal to a hosting server and fixing port errors.
knowledge
- Read time
- 5 min
- Sections
- 8
- Updated
- 14 Nov 2026
- Written by
- WebJi® team
Last editorial update: 14 November 2026. Prices follow the dated sources on this page; checkout confirms current charges.
What port does SFTP use?
SFTP uses TCP port 22 by default, the same port as SSH, because SFTP is a subsystem that runs inside an SSH connection. One encrypted connection carries the login, directory listings and file data, so there is no second data port, which is why SFTP passes through firewalls that break passive FTP.
The port belongs to the SSH daemon, not to SFTP. If an administrator moves SSH to port 2222, SFTP moves with it and your client must use 2222 too. FTP and FTPS are different protocols on different ports; the full comparison is in FTP vs SFTP.
| Protocol | Default port | Encryption | Data channel |
|---|---|---|---|
| SFTP (SSH File Transfer Protocol) | 22/TCP | SSH | Same connection |
| FTP | 21/TCP control, 20 or a passive range for data | None | Separate |
| FTPS explicit | 21/TCP, upgraded with AUTH TLS | TLS | Separate |
| FTPS implicit | 990/TCP | TLS from the start | Separate |
| SCP | 22/TCP | SSH | Same connection |
Port numbers for HTTPS, HTTP, email and databases
HTTPS uses TCP 443 (and UDP 443 for HTTP/3), plain HTTP uses 80, and mail uses 587 or 465 to send and 993 (IMAP) or 995 (POP3) to read over TLS. These are the ports most often confused with SFTP when a hosting connection fails.
| Service | Port | Notes |
|---|---|---|
| HTTP | 80/TCP | Normally redirects to HTTPS |
| HTTPS | 443/TCP, 443/UDP for HTTP/3 | Needs a certificate bound to the site |
| SMTP submission | 587 (STARTTLS) or 465 (implicit TLS) | Port 25 is for server-to-server delivery |
| IMAP | 143, or 993 with TLS | Keeps mail on the server |
| POP3 | 110, or 995 with TLS | Downloads mail to one device |
| MySQL / MariaDB | 3306/TCP | Should not be open to the public internet |
| RDP | 3389/TCP | Windows remote desktop |
If https:// times out while http:// loads, port 443 is blocked or no certificate is bound to the site: a firewall or virtual-host problem, not an SFTP one. The abbreviations themselves are expanded in hosting full forms.
What port to enter in FileZilla for SFTP
In FileZilla, set Protocol to “SFTP – SSH File Transfer Protocol” and use port 22, or leave the port blank for the default; choose “FTP” only if your host offers FTP on port 21. A protocol and port that do not match is the most common FileZilla error.
- Open File → Site Manager → New site.
- Set Protocol to SFTP – SSH File Transfer Protocol.
- Enter the Host as your domain or server IP, without an
sftp://prefix. - Leave Port empty for 22, or type the custom port your host gave you.
- Set Logon Type to Normal with a password, or Key file for an SSH key.
- Click Connect; a listing of your home folder means the port and protocol agree.
The same settings work in WinSCP and Cyberduck. Uploading a site this way is shown step by step in how to upload a website with FTP or SFTP.
How to connect to SFTP on a custom port from the command line
Use sftp -P 2222 user@server; note the capital -P, which is the port flag for both sftp and scp, while ssh uses lowercase -p. Mixing them up is a frequent cause of “connection refused” on the wrong port.
sftp user@example.com # default port 22
sftp -P 2222 user@example.com # custom port
scp -P 2222 site.zip user@example.com:~/
ssh -p 2222 user@example.com # interactive shell, lowercase -pTo save the port, add a host entry to ~/.ssh/config with Port 2222; sftp, scp and ssh all read it. More copy examples are in the scp command guide.
How to change the SFTP port on a Linux server
Change the SSH port and SFTP follows; keep port 22 open and your current session connected until the new port is proven, or you can lock yourself out. The method depends on whether your distribution starts SSH through systemd socket activation.
- Add
Port 2222below the existingPort 22line in/etc/ssh/sshd_config, so both ports listen during the change. - Open the firewall:
sudo ufw allow 2222/tcp, orsudo firewall-cmd --add-port=2222/tcp --permanent && sudo firewall-cmd --reload. On a VPS, also allow it in the provider's network firewall if one is used. - On SELinux systems (AlmaLinux, Rocky, RHEL):
sudo semanage port -a -t ssh_port_t -p tcp 2222. - Apply the change for your system, as in the table below.
- From a second terminal, run
ssh -p 2222 user@server. Only when it works, removePort 22, apply again and confirm 22 is refused.
| System | How SSH starts | Apply the change |
|---|---|---|
| Ubuntu 24.04 and later | ssh.socket, port read from sshd_config | sudo systemctl daemon-reload && sudo systemctl restart ssh.socket |
| Ubuntu 22.10 – 23.10 | ssh.socket, port set in a drop-in | Set ListenStream= then ListenStream=2222 in /etc/systemd/system/ssh.socket.d/listen.conf, then daemon-reload and restart ssh.socket |
| Ubuntu 22.04, Debian, AlmaLinux, Rocky | ssh / sshd service | sudo systemctl restart ssh (Debian/Ubuntu) or sudo systemctl restart sshd (RHEL family) |
Check with sudo ss -tlnp | grep -E ':22|:2222'. A different port reduces automated login noise in the logs but is not security by itself; keys and fail2ban do the real work. On shared Linux hosting the provider sets the port; do not change sshd on a server you do not administer.
Why is my SFTP connection refused or timing out?
“Connection refused” means nothing is listening on that port, “timed out” means a firewall is dropping the packets, and “permission denied” means the port is fine but authentication failed. Read the exact message before changing any setting.
| Message | Likely cause | Fix |
|---|---|---|
| Connection refused | Wrong port, or SSH stopped | Confirm the port with ss -tlnp; check systemctl status ssh |
| Connection timed out | Firewall or network blocking the port | Open it in ufw/firewalld and any provider firewall; try another network |
| Connection closed by remote host | Too many failed logins, often a fail2ban ban | Unban your IP, then switch to key login |
| Permission denied (publickey) | Key not offered or not in authorized_keys | Use -i with the right key, or add it on the server |
| Server refused our key | Wrong user or loose permissions | Set ~/.ssh to 700 and authorized_keys to 600 |
Test the path without a client: nc -zv example.com 22 on Linux or macOS, or Test-NetConnection example.com -Port 22 in Windows PowerShell. Success means the port is open and the problem is the login. Server-side diagnosis is covered in SSH connection refused on a VPS, and key setup in generating an SSH key on Ubuntu.
What to do when port 22 is blocked on your network
Some office and public Wi-Fi networks block outbound port 22; the fix is to have SSH listen on an additional allowed port, such as 2222, or connect through a VPN. Port 443 also works for SSH, but only on an IP address where no web server already uses 443.
Your own public address, useful when a host asks which IP to whitelist, is shown by what is my IP. A WebJi® VPS includes root SSH access, so you can set the port yourself; the VPS is listed from ₹499 a month plus GST (published price read 29 October 2026; checkout confirms it).
Frequently asked questions
Is SFTP port 22 or 21?
SFTP is port 22. Port 21 belongs to FTP and explicit FTPS, which are different protocols. If a client is set to FTP on 21 and the server only runs SSH, the connection is refused; switch the protocol to SFTP and the port to 22.
Can SFTP and SSH use different ports on the same server?
Not with a single SSH daemon, because SFTP is served by sshd itself. You can make sshd listen on two ports at once, or run a second sshd instance with its own config and port, for example to give SFTP-only users a separate entry point.
Is port 990 SFTP?
No. Port 990 is implicit FTPS, which is FTP wrapped in TLS. In FileZilla that is the “Require implicit FTP over TLS” encryption option under the FTP protocol, not the SFTP protocol.
Do I need to open passive ports for SFTP?
No. Passive port ranges are only for FTP and FTPS, which open separate data connections. SFTP sends everything over the single SSH connection, so the SSH port is the only one the firewall needs to allow.
Checked 14 November 2026 against OpenSSH and Ubuntu documentation · Reviewed by the WebJi® team, Jaipur.
Ready to get started with WebJi®?
Join 12,000+ businesses across India and overseas. INR pricing, 18% GST shown before payment and 24/7 email support in Hindi and English — average first reply under 60 minutes.