How to Use SFTP: Upload and Download Files Safely

13 min read

SFTP lets you move files between your computer and your server. You drag a file from one side of the window to the other, and it’s on your server. The connection is encrypted, so nobody can read your password or your files on the way.

If you have never used it before, start at the top. If you just need a command, skip to the cheat sheet.

What SFTP Is, in One Minute link

Three names get mixed up a lot, and only two of them are safe:

• SFTP stands for SSH File Transfer Protocol. It runs over SSH, the same secure connection you use to log in to a server, so it uses the same username, password or key, and the same port (usually 22).
• FTP is the older way to do the same job. Plain FTP sends your password as readable text, so avoid it.
• FTPS is FTP with encryption added. It’s safe, but it’s a different protocol from SFTP and uses different ports.

Do You Have SFTP? link

SFTP needs SSH access, so it depends on your plan.

On shared hosting, follow the same steps in your client but choose FTP with explicit TLS instead of SFTP, and use an account from cPanel > FTP Accounts. The rest of this guide still makes sense, only the connection settings differ.

The Four Things You Need link

Every SFTP client asks for the same four details. Write them down before you start.

Where these come from:

• VPS, Business Cloud and dedicated servers: the IP and the root password are in the client area under your service. If you followed the SSH guide and turned off root login, use the user you created there instead.
• Enhance: you get two ways in. For SFTP, open the website in Enhance and go to Developer tools. Add your SSH key there, then connect on port 22 with the username and server address Enhance shows you. The same login also opens the website’s own shell if you connect with ssh. Enhance also runs a normal FTP server. You create FTP accounts for each website under its Advanced menu, and each one can be limited to a single folder with Directory access. FTP accounts log in with an email-style username such as [email protected] on port 21, and they’re handy for a developer or a tool that only speaks FTP. When you have the choice, use SFTP. To change a password, see Resetting Passwords.
• cPanel on a VPS: a cPanel account can use SFTP only if shell access is turned on for it in WHM > Manage Shell Access. Use the cPanel username and password.

Pick a Client link

You need an SFTP program, called a client, on your computer. All of these are free.

  sftp root@your-server-ip
  

  sftp -P 2222 root@your-server-ip
  

Where Your Website Files Live link

Once you’re connected, you need the right folder. Upload to the wrong place and your site won’t change.

Not sure? Look for the folder that holds index.html, index.php or wp-config.php. That’s your website.

Examples for Beginners link

These are the jobs people use SFTP for most. Each one uses FileZilla, but the steps are the same in any client.

Example 1: Put Your First Web Page Online link

You’ve made a simple website on your computer, and you want it live.

1. On your computer, put your files in one folder, for example my-site, with index.html inside it.
2. Connect to your server.
3. On the right (the server side), open your website folder, such as public_html.
4. On the left, open your my-site folder.
5. Select everything inside my-site and drag it to the right.
6. Visit your domain in a browser. You should see your page.

Example 2: Download a Backup Copy Before You Change Anything link

Before you update a theme, edit code or try a new plugin, keep a copy of what works.

1. On your computer, make a folder called something like backup-2026-11-13. Using the date helps you find it later.
2. Connect, and open your website folder on the right.
3. Open your backup folder on the left.
4. Drag the website files from right to left.

Now you can put any file back exactly as it was. For a database backup as well, see Backups and Restores.

Example 3: Fix a WordPress Site That a Plugin Broke link

You installed or updated a plugin and now your site shows a white page or a critical error, and you can’t reach the dashboard. SFTP gets you back in.

1. Connect and open public_html/wp-content/plugins.
2. Find the folder of the plugin that caused it. Right-click it and choose Rename.
3. Add -off to the name, for example contact-form-7-off.
4. Reload your site. WordPress can’t find the plugin any more, so it switches it off.
5. Log in to your dashboard and update or remove the plugin properly. Then rename the folder back, or delete it.

Not sure which plugin it was? Rename the whole plugins folder to plugins-off. If the site comes back, rename it back to plugins and turn plugins on one at a time from the dashboard. For more fixes, see Fix WordPress White Screen of Death.

Example 4: Edit a File Safely link

You need to change one setting in wp-config.php or .htaccess.

1. Download the file to your computer.
2. Make a copy of it, called something like wp-config-original.php, and keep it aside.
3. Open the file in a plain text editor. Use Notepad++ or VS Code on Windows, TextEdit in plain text mode on macOS, or any code editor. Don’t use Word.
4. Make your change and save.
5. Upload it back to the same folder and confirm overwriting.
6. Check your site. If something broke, upload the original copy and you’re back where you started.

FileZilla can also do this for you: right-click a file on the server and choose View/Edit. When you save, it asks whether to upload the changed file.

Example 5: Upload a Big Site Quickly link

Moving hundreds of files one at a time is slow. Sending one archive is much faster.

1. On your computer, zip your site folder into site.zip.
2. Upload site.zip to your website folder.
3. Log in with SSH, go to that folder and unpack it:

  cd /var/www/html
unzip site.zip
rm site.zip
  

If unzip isn’t installed, add it with sudo apt install unzip on Ubuntu or Debian, or sudo dnf install unzip on AlmaLinux or Rocky Linux.

Command Cheat Sheet link

In the command-line sftp tool, plain commands act on the server. Put an l (for “local”) in front to act on your computer: ls lists the server, lls lists your computer.

A short session looks like this:

  $ sftp root@your-server-ip
sftp> cd /var/www/html
sftp> lcd ~/Desktop/my-site
sftp> put -r .
sftp> ls
index.html  style.css  images
sftp> exit
  

One-Line Commands link

Sometimes you just want to send one file without opening a session. scp does that. Like sftp, it uses a capital -P for the port.

  # Upload one file
scp site.zip root@your-server-ip:/var/www/html/

# Download one file
scp root@your-server-ip:/var/www/html/wp-config.php .

# Upload a whole folder
scp -r my-site root@your-server-ip:/var/www/
  

To back up a big site, pack it on the server and download one archive:

  ssh root@your-server-ip "tar -czf /root/site-backup.tar.gz -C /var/www html"
scp root@your-server-ip:/root/site-backup.tar.gz .
  

For keeping two folders in sync (only sending what changed), rsync is the better tool:

  rsync -avz --progress my-site/ root@your-server-ip:/var/www/html/
  

The slash at the end of my-site/ matters: it sends the folder’s contents, the same as Example 1.

After You Upload: Permissions and Ownership link

If your page shows 403 Forbidden or WordPress can’t save uploads, the files probably have the wrong permissions or owner.

• Folders should be 755 and files 644. Most clients let you right-click and choose File permissions (FileZilla) or Properties (WinSCP).
• wp-config.php can be stricter, 640 or 600.
• Owner: on your own Nginx or Apache server, files uploaded as root belong to root, and the web server may not be able to write to them. Give them to the web server user over SSH:

  # Ubuntu and Debian
sudo chown -R www-data:www-data /var/www/html
  

On AlmaLinux or Rocky Linux, the user is apache or nginx, depending on which one you installed.

You don’t need to change ownership on Enhance or cPanel. There, the website’s own user already owns its files. For more on this error, see Fix 403 Forbidden Error.

Keep It Secure link

• Use SSH keys instead of passwords. The SSH guide shows how, and all the clients above can use them.
• Give each person their own login. On Enhance, create an FTP account for your developer, or add their SSH key, and remove it when the job is done. Never hand out your root password.
• Protect saved passwords. FileZilla can lock them behind a master password under Edit > Settings > Interface > Passwords.
• If you once installed an FTP server and no longer use it, remove it and close port 21. See the VPS Security Checklist.

Troubleshooting link

Next Steps link

• Connecting to Your Server via SSH: set up the keys SFTP uses
• Managing Files with cPanel File Manager: the browser option on shared hosting
• Website Migration Checklist: moving a whole site to GoZen