What Is FTP (File Transfer Protocol)?

FTP stands for File Transfer Protocol. It’s a method for transferring files between your computer and your web server. When you need to upload a WordPress theme, download a backup, edit a configuration file, or move an entire website’s files, FTP is one of the tools that makes it possible.

FTP has been around since 1971. It was designed long before security was a concern on the internet, and that’s the important thing to understand about it. Plain FTP sends everything, including your username and password, as readable text. Anyone intercepting the connection can see your login credentials and your files. That’s why you should never use plain FTP in 2026.

Use SFTP instead. Same job, encrypted connection.

FTP vs SFTP vs FTPS

These three terms get mixed up constantly. Here’s how they differ.

FTP is the original protocol. No encryption. Your credentials and file contents travel across the network in plain text. Some older or cheap hosts still default to it, but there’s no good reason to use it today.

FTPS adds a TLS encryption layer on top of FTP. It encrypts the connection, making it safe for transferring files. It works, but it can be fiddly with firewalls because it uses multiple ports.

SFTP (SSH File Transfer Protocol) is a completely separate protocol that runs over SSH. It encrypts everything through a single connection on port 22. It’s simpler to configure, works better with firewalls, and is the standard for secure file transfers. Most modern hosts support SFTP, and it’s what you should use by default.

When your host says they support “FTP access,” check whether they mean plain FTP or SFTP. If they only offer plain FTP with no SFTP option, that’s a red flag about how seriously they take security.

When Do You Actually Need FTP?

Most people never need FTP if they’re on shared hosting with a control panel. cPanel’s File Manager, Plesk’s file interface, and hPanel’s built in tools handle everyday file tasks through the browser. You can upload, edit, move, and delete files without connecting an FTP client.

That said, there are situations where an FTP client (using SFTP) is the better tool.

Uploading large files or many files at once. Browser based file managers struggle with large uploads and bulk file transfers. An FTP client handles them reliably and lets you resume interrupted transfers.

Migrating a site manually. If you’re moving a website from one host to another without a migration plugin, downloading the entire site via SFTP and re-uploading it to the new host is the most reliable method.

Editing files when your site is broken. If a plugin update crashes your WordPress site and you can’t access the admin panel, connecting via SFTP lets you rename or delete the problem plugin from the /wp-content/plugins/ folder to get back in.

Managing files on a VPS. If you’re running a VPS without a control panel, SFTP is how you manage files visually instead of using command line tools.

Working with a developer. Developers often prefer SFTP because it integrates with code editors and deployment tools. Many code editors (VS Code, Sublime Text) have SFTP extensions that let you edit files directly on the server.

How to Connect With an FTP Client

The most popular FTP client is FileZilla. It’s free, works on Windows, Mac, and Linux, and supports FTP, FTPS, and SFTP. Here’s how to connect.

Step 1: Get your credentials. Your hosting provider gives you four pieces of information: the host (server address), username, password, and port number. You’ll find these in your hosting welcome email or in your control panel under FTP Accounts. For SFTP, the port is usually 22. For FTP, it’s 21.

Step 2: Open FileZilla. At the top of the window, you’ll see four fields: Host, Username, Password, and Port.

Step 3: Enter your details. Type your server address in Host (e.g. ftp.example.com or your server’s IP address). Enter your FTP username and password. Set the port to 22 for SFTP or 21 for FTP.

Step 4: Click Quickconnect. FileZilla connects to your server. If it’s your first time connecting via SFTP, you’ll see a prompt asking you to trust the server’s key. Click OK. The left panel shows your local computer. The right panel shows your server.

Step 5: Navigate and transfer. On the server side (right panel), navigate to your website’s root directory. This is usually public_html or www or htdocs. To upload a file, drag it from the left panel to the right. To download, drag from right to left. FileZilla shows transfer progress at the bottom.

Common connection problems:

• Connection refused. The host, port, or protocol is wrong. Double check that you’re using SFTP on port 22, not FTP on port 21 (or vice versa).
• Authentication failed. Wrong username or password. FTP credentials are often different from your hosting account login. Check cPanel under FTP Accounts for the correct ones.
• Timeout. Your IP might be blocked by the server’s firewall after too many failed login attempts. Contact your host’s support to unblock it, or wait 15 to 30 minutes for the block to expire.
• Can’t see files. You might be in the wrong directory. Navigate to public_html to find your website files. If you’re connected as a secondary FTP user, your access might be limited to a specific folder.

Other FTP Clients

FileZilla is the most common, but there are alternatives depending on your setup.

Cyberduck is a clean, simple client for Mac and Windows. Supports FTP, SFTP, and cloud storage services like S3 and Google Drive. Free and open source.

WinSCP is a Windows only client that’s popular with developers. Supports SFTP and SCP (another SSH based transfer protocol). It includes a built in text editor and can sync local and remote folders.

Transmit is a paid Mac client ($45) that’s fast and polished. Supports SFTP, FTP, and cloud services. If you’re on Mac and transfer files frequently, it’s worth the price.

VS Code with SFTP extension. If you’re a developer already using VS Code, the SFTP extension lets you upload files to your server every time you save locally. No separate FTP client needed.

FTP Accounts in cPanel

Most shared hosting plans let you create multiple FTP accounts through cPanel. This is useful when you want to give someone access to your server files without sharing your main hosting login.

You can create an account that’s restricted to a specific directory. For example, give a web designer access to just the /wp-content/themes/ folder so they can upload and edit theme files without being able to touch anything else. Each account has its own username, password, and directory restriction.

To create an FTP account in cPanel, go to Files > FTP Accounts. Enter a username, password, and the directory you want to restrict access to. Click Create. The new account can then connect using an FTP client with the credentials you set.

Security Best Practices

Always use SFTP over plain FTP. This is the single most important point. SFTP encrypts everything. FTP encrypts nothing.

Use strong passwords for FTP accounts. FTP accounts are a common target for brute force attacks. Use a unique password with at least 16 characters. A password generator can help.

Delete FTP accounts you don’t need. If you created a temporary account for a developer or designer, remove it when the work is done. Every active FTP account is a potential entry point.

Restrict directory access. When creating accounts for other people, limit them to the specific folder they need. Never give full root access unless absolutely necessary.

Change passwords after sharing them. If you gave someone your FTP credentials, change the password once they’re done. Even trusted people can have their own devices compromised.

Check your host’s FTP logs. If your hosting control panel shows FTP access logs, review them periodically. Unexpected connections from unfamiliar IP addresses could indicate unauthorized access.

Frequently Asked Questions

Do I need FTP to manage my website?

Not necessarily. If you’re on shared hosting with a control panel like cPanel, the built in File Manager handles most tasks. FTP becomes useful for bulk uploads, site migrations, and troubleshooting when your site is down and you can’t access the admin panel.

What’s the difference between FTP and SSH?

FTP is specifically for transferring files. SSH (Secure Shell) gives you full command line access to your server. You can do everything through SSH that FTP does and much more, but it requires typing commands instead of dragging and dropping files. SFTP combines the visual file transfer experience with SSH’s encryption.

Is FileZilla safe to use?

FileZilla itself is safe and widely used. Be careful to download it from the official site (filezilla-project.org) rather than third party download sites, which sometimes bundle it with unwanted software. Also make sure you connect using SFTP (port 22) rather than plain FTP (port 21) for a secure connection.

My host only offers FTP, not SFTP. Is that a problem?

Yes. It means your login credentials are transmitted in plain text every time you connect. If your host doesn’t support SFTP, consider it a reason to look elsewhere. Every reputable host in 2026 should offer SFTP or SSH access on all plans.

← Back to Web Hosting Glossary