What Is FTP? How File Transfer Protocol Works and Why to Use SFTP Instead (2026)

What is FTP? The file transfer protocol: how it works and why you should move to SFTP — What is FTP? A protocol older than the web that still uploads website files, and why you should leave it for SFTP today

💡 Affiliate Disclosure: This post contains affiliate links. If you buy through them, we may earn a commission at no extra cost to you. Affiliate Disclosure.

📅 Updated October 2026 The explanation draws on the original specification RFC 959 (October 1985), RFC 4217 (October 2005), the FileZilla wiki, the official WordPress hardening guide, Mozilla's security blog, the Chrome 95 release notes and Hostinger's help pages. Plan details for Hostinger, IONOS and Bluehost were read on their own pages on October 12, 2026.

A developer tells you to "upload the files over FTP." Your host tells you to "use SFTP on port 65002." And the WordPress guidelines say "use SFTP if your host provides it." So what is the difference between the three? Why do today's browsers not open ftp:// links? And is plain FTP still a risk? This article explains the protocol from the ground up, then gives you practical steps to connect to your site in an encrypted way.

The short version: FTP (File Transfer Protocol) is a very old language between a program on your computer and a hosting server for uploading and downloading files, and it sends your password and your files without encryption. The safe alternatives are SFTP (over SSH) and FTPS (FTP with TLS). If you can choose, choose SFTP.

📋 Quick summary: FTP, FTPS and SFTP in one table

Item	FTP	FTPS	SFTP
Basis	The original file transfer protocol (1985)	FTP itself with TLS encryption	A different protocol that runs over SSH
Encryption	None: the password and the files travel in the open	Encrypted with TLS	Encrypted with SSH
Usual ports	21 for commands, plus a data port	21 (explicit) or 990 (older implicit), plus a data port	One connection, usually 22, though your host may choose another (Hostinger uses 65002)
Number of connections	Two: commands and data	Two	One
Recommendation	Avoid it except on a trusted network for non-sensitive files	Acceptable if SFTP is not available	The first choice if your host offers it

What is FTP? The definition and the roots

FTP stands for File Transfer Protocol. Its official specification is RFC 959, issued in October 1985, years before the web existed. It lists four objectives: to promote sharing of files and programs, to encourage indirect use of remote computers through programs, to shield the user from differences in file storage systems between machines, and to transfer data reliably and efficiently. It says the protocol was designed mainly for use by programs, though it can also be used directly from a terminal.

What does it do in practice?

It lets your computer (the client) connect to the hosting server, which shows you its folders and lets you upload, download, delete or rename a file. This is what developers do when they "upload the site" to hosting, and what programs such as FileZilla do.

Why is its specification considered old?

Because it was written for a different world: small university and government networks whose members knew one another. The specification says the control channel follows the Telnet protocol, that the argument of the password command (PASS) is a Telnet string, and that hiding the password from the screen is the job of the client program. It contains no encryption mechanism at all. Encryption came later through separate additions (see below).

How does FTP work? Two connections, not one

What sets FTP apart is that it uses two connections instead of one, and this is the cause of most of its trouble with firewalls:

The control connection. The client opens it to port 21 on the server, and the commands and replies travel over it: the user name and password (USER and PASS), a request to list a folder, a request to upload a file.
The data connection. A separate connection opened for each transfer, carrying the file's content or the folder listing, then closed.

The data connection has two modes, and the specification describes their basis. The server's default data port is the one adjacent to the control port (so 20 when control is on 21), and the PASV command asks the server to "listen" on another port and wait, then returns its address and port to the client.

Mode	Who starts the data connection?	Effect on networks
Active	The server connects to the client on a port the client chooses (the PORT command)	The client has to accept an incoming connection, which a device firewall or a router often blocks
Passive	The client connects to the port the server announced (the PASV command)	Best for clients behind a router, but the server needs a range of ports open in its firewall

That is why modern connection programs use passive mode by default. A symptom you may meet, "the login works but the file list hangs," is the well-known sign of this data-port problem, and we return to it in the errors section.

Why is plain FTP warned against?

Because everything in it travels unencrypted. Mozilla's security blog says the biggest risk in FTP is that it transfers data in cleartext, which lets attackers steal, spoof and modify it, and that many malware campaigns start by compromising FTP servers and delivering the malware to the user's machine over the same protocol. The official WordPress hardening guide describes the fix: use SFTP if your host provides it (and ask if you are not sure), because your password and data are encrypted in transit, so they are never sent in the clear and cannot be intercepted.

What does this mean for you?

Connecting to your site over FTP from a public network (a cafe, an airport or a hotel) may expose your user name and password to anyone watching the network.
Whoever gets your FTP details can upload a malicious file to your site or change existing files, which is more damaging than merely reading content.
Other protections such as HSTS or HTTPS-Only mode do not apply to FTP, as Mozilla says.

A note on browsers: Mozilla stopped supporting FTP in Firefox 90 (July 2021) after disabling it by default in version 88, citing its security. Google removed support for FTP links from Chrome in version 95 (October 2021), and Chrome's stated reason was that use of FTP in the browser is too low to justify improving its client, and that more capable clients are available on every platform. So if you open an ftp:// link today, you will need a dedicated program.

🔐 Want hosting that offers SFTP from its control panel?
Hostinger: its help center says SFTP is available on plans that include SSH access, which means Premium and above, and the port is 65002
☑️ See Hostinger plans

The safe alternatives: FTPS and SFTP

FTPS: FTP with TLS

It is FTP itself, but over a channel encrypted with TLS. The specification that governs it is RFC 4217 (October 2005), which builds on the security extensions in RFC 2228. It comes in two modes, according to the FileZilla wiki:

Explicit: the client connects to the usual FTP port and then asks to switch to TLS with the AUTH TLS command. In FileZilla you type FTPES:// before the server name.
Implicit: an older mode that assumes TLS from the first moment and normally runs on port 990. In FileZilla you type FTPS:// and usually set the port to 990.

The wiki points out that encryption with the PROT P command covers the file transfers, and that if the server does not enforce it, a client could send PROT C and transfer files unencrypted, so ask your host to enforce it. FTPS also keeps the two-connection design, so it inherits the port problems.

SFTP: not FTP at all

The name misleads: SFTP (SSH File Transfer Protocol) is not a version of FTP but a different protocol that runs over SSH. The OpenBSD manual page for the sftp command describes it as a file transfer program similar to ftp that performs all operations over an encrypted SSH transport, and that uses SSH features such as public key authentication and compression. Because it is a single connection, there is no data-port problem. The usual port is 22, but some hosts choose another: on Hostinger's shared hosting it is 65002.

Comparison	The difference
FTP vs SFTP	The first is unencrypted and uses two connections; the second is encrypted, uses one connection and relies on SSH
FTPS vs SFTP	Both are encrypted. The first is FTP protected by a TLS certificate and inherits the multiple ports; the second is the SSH protocol with a single port and optional key authentication
FTP vs HTTP	HTTP shows pages to visitors; FTP manages files behind the scenes with an account that belongs to the site owner
A client (FileZilla) vs the control panel's file manager	A file manager (such as the one in cPanel) works from the browser and suits editing a few files; a client suits moving whole folders between your computer and the server

What is this actually good for? Three common cases

1. Uploading your site or moving it from one host to another

You usually have to download the files from the old host and upload them to the new one. Check what each host's own instructions ask for: some migration tools ask for access to your files, which is usually FTP or SFTP, so ask whether they accept SFTP before you hand over login details.

2. Managing WordPress

You do not need FTP every day to run WordPress, but it helps when you are fixing a site that broke because of a plugin (by renaming its folder) or uploading a theme by hand. That is exactly why the connection has to be secure.

3. Quick backups

You can download the whole wp-content folder with a client. That is useful, but it does not replace full backups that include the database, made from the control panel or a plugin.

🌐 Want hosting that mentions SSH and SFTP on its page?
IONOS: its web hosting page lists SSH, SFTP and WP-CLI among the tools for developers
☑️ See IONOS hosting

How do you connect to your site over SFTP instead of FTP? Steps with FileZilla

The steps are based on Hostinger's official help pages and the FileZilla wiki, and they are similar at most hosts, with different field names:

Make sure your plan offers SFTP. Look in the hosting control panel for an SSH, SFTP or "remote access" section. At Hostinger, for example, SFTP is available on plans that include SSH (Premium and above). If you cannot find it, ask support.

Turn on SSH and get the connection details. From the panel take the server address (host), the user name and the port. Do not assume it is 22: Hostinger shared hosting shows 65002.

Install FileZilla Client. Download the client version from the official project site, not the server version, and install it on your computer.

Create a site in Site Manager. Click New Site and choose the protocol SFTP - SSH File Transfer Protocol, then enter the address, the port, the logon type Normal, the user name and the password.

Connect and check the server's fingerprint. On the first connection a message appears: "Unknown host key." Check that the fingerprint shown matches the one your host displays, if it provides one, then agree to trust the server. After that its folders appear, and most WordPress sites live in the public_html folder.

If SFTP is not available, use explicit FTPS. Type FTPES:// before the server name, or choose "Require explicit FTP over TLS" in the settings, and avoid "Only use plain FTP (insecure)" unless you have no other choice.

Hygiene rules after you connect

Use a unique password for the file account, and never reuse your control panel or email password.
Delete old FTP/SSH accounts you no longer use (a former developer, or a migration tool that has finished its job).
If your host allows signing in with an SSH key, use it instead of a password, because the sftp manual page lists public key authentication as a built-in feature.
Do not save the password in a program on a shared computer.
Update your client program regularly from its official site.

Common connection errors and their fixes

Symptom	Likely cause	Fix
Login works, then the file list hangs and times out	A data-port problem: a firewall or router blocks the second connection	Use passive mode, and if you manage the server, open the passive data port range in its firewall
Connection refused or timed out on port 22	Your host uses a different port for SFTP	Read the port from your hosting panel (Hostinger shared: 65002)
"Unknown host key" on the first connection	Normal: the client does not know the server yet	Compare the fingerprint with what your host shows, then agree to trust it
"The server does not support FTP over TLS"	The server does not offer FTPS	Ask your host for SFTP. Do not switch to plain FTP unless you must, and only on a trusted network
Login fails with the correct password	You are using your control panel account instead of the FTP/SSH account, or SSH is not turned on	Create or reset the file account from the panel and turn on SSH

💻 Want a plan whose feature list shows SSH from the first tier?
Bluehost: its shared hosting comparison lists SSH and WP-CLI and a WordPress staging site on all three plans, starting with Starter
☑️ See Bluehost plans

🎯 Who needs to know FTP, and who can skip it?

✅ You need it if you:

Run a site on shared hosting or a VPS and upload files yourself
Move a site between two hosts
Fix a broken WordPress site and can no longer get into the control panel
Are asked by a developer or partner for your "FTP details"

⚠️ You do not need it if you:

Run your site on a closed platform (a store or a site builder) that gives you no file access
Are happy with the file manager in your hosting panel
Publish through an automated tool (Git or a deployment service) that does not go through you

If you manage a VPS, you control all of it: SFTP is available over SSH, and you can switch off the plain FTP service yourself if you do not need it.

🏆 The verdict: what to do after reading this

Use SFTP if your host offers it; otherwise ask for explicit FTPS, and keep plain FTP for exceptional cases on a trusted network. Avoid a host that offers only plain FTP with no encrypted option, because you would then be doing exactly what Mozilla and the WordPress guide warn against.

Check your hosting panel now: does it mention SSH or SFTP? What is the port?
Try connecting with FileZilla using the steps above, and close the old plain FTP connection.
Delete file accounts you do not use.
Make the account passwords unique, and turn on two-factor authentication on your hosting panel if it is available.

✅ Frequently asked questions about FTP

❓ What is FTP?

The File Transfer Protocol: a language that programs on your computer use to talk to a remote server to upload, download, delete and rename files. Its official specification, RFC 959, was issued in October 1985.

❓ Is FTP safe?

Plain FTP is not safe because it sends the user name, the password and the files without encryption, so they can be intercepted or altered, as Mozilla says. Use SFTP or explicit FTPS instead.

❓ What is the difference between FTP and SFTP?

FTP is an old unencrypted protocol that uses two connections (commands and data). SFTP is a different protocol that runs over SSH and encrypts everything over one connection. The similar name misleads: SFTP is not FTP with an add-on.

❓ What is the difference between SFTP and FTPS?

Both are encrypted. FTPS is FTP itself protected with TLS (explicit on port 21 or implicit on 990) and keeps two connections, while SFTP runs over SSH on one connection and supports key authentication. If your host offers both, SFTP is simpler with firewalls.

❓ What are port 21 and port 20?

Port 21 is the control connection port, which carries the commands. According to the specification, the server's default data port is the one adjacent to it (20), used in active mode. In passive mode the server opens another port and announces it to the client.

❓ What is the difference between active and passive mode in FTP?

In active mode the server connects to the client to send the data, which the client's firewall often blocks. In passive mode (PASV) the client connects to a port the server announces, which is best for clients behind routers but requires an open port range on the server.

❓ Why does my browser not open ftp:// links?

Mozilla ended FTP support in Firefox 90 (July 2021) for security reasons, and Google removed FTP link support from Chrome 95 (October 2021) because its use is low. Open these links with a dedicated program such as FileZilla.

❓ Which port do I use for SFTP?

The usual port is 22, but your host may choose another. On Hostinger shared hosting it is 65002, according to its help pages. Read the connection details from your hosting panel and do not assume.

❓ Do I need SSH to use SFTP?

Yes, because SFTP runs over SSH. Some hosts tie it to the plans that include SSH: Hostinger says SFTP is available on plans with SSH access (Premium and above).

❓ Do I need FTP for a WordPress site?

Not day to day. You run and update WordPress from its dashboard, but connecting to the files helps when the site breaks or when you move it. The official WordPress guide advises connecting over SFTP if your host provides it.

❓ Which program should I use to connect?

FileZilla Client is a program that Hostinger's help pages walk you through, and its project wiki explains setting up FTP over TLS. There are others, such as WinSCP on Windows. What matters is that it supports SFTP or explicit FTPS and that you download it from its official site.

❓ Why does the connection hang after login?

Usually a data-port problem in passive mode: the control connection works and a firewall or router blocks the data connection. Try connecting from another network, or switch to SFTP, which needs no separate data connection, or ask your host about its passive port range.

🛡️ Start with what your host offers: SFTP first
Confirm the port and the login details from the hosting panel before you connect. Hostinger's help center documents SFTP on plans with SSH access
☑️ See Hostinger hosting

Do you still upload your files over plain FTP? Tell us in the comments what has stopped you from moving to SFTP.