FTP moves files between your computer and your web server. It is the right tool for transferring many files at once and unnecessary for small edits, which the hosting file manager handles. The setting that matters is using the secure version, since plain FTP sends your password across the network unprotected.
What it does
Connects your computer to your web server so you can move files in both directions, the way a file manager moves things between folders on your own machine.
You supply a server address, a username, a password, and a port. The client shows your local files on one side and the server's on the other, and files are dragged between them.
That is the whole concept. What causes confusion is that there are several protocols doing this job and they are not equally safe.
FTP, FTPS, and SFTP
| Protocol | Assessment |
|---|---|
| FTP | The original. Sends your username, password, and files unencrypted. Avoid. |
| FTPS | FTP with encryption added. Safe, and configuration is occasionally awkward. |
| SFTP | A different protocol entirely, running over a secure connection. The sensible default where the host supports it. |
The names are unhelpfully similar and the distinction is real. Plain FTP transmits your credentials in a form anyone on the same network can read, which on shared or public connections is a genuine exposure rather than a theoretical one.
If your host offers SFTP, use it. If not, use FTPS. If only plain FTP is available, that is worth asking about, because it says something about how the hosting is run.
When you actually need it
- Uploading many files at once, such as a folder of images or a whole site. The control panel file manager becomes slow and unreliable past a certain volume.
- Downloading a full copy of the site, which is the practical way to keep your own backup of a hand-built site.
- Working with a developer's tools, where an editor is configured to publish directly.
- Moving a site between hosts, where you are pulling everything down and pushing it back up.
When the control panel is better
For most site owners, most of the time.
Editing one file, checking whether something exists, changing a permission, or looking at a folder are all faster in the hosting file manager, which needs nothing installed and works from any machine including someone else's.
The rule of thumb: one file, use the file manager. Many files, use SFTP. Where the folder structure itself is unfamiliar, that is covered in understanding the file structure on your server.
Getting the details
Four things, all from your hosting control panel.
- Host, which is usually your domain or a server address the host provides.
- Username, either your main account or a separate account you create.
- Password, set by you.
- Port, which is 21 for FTP and FTPS, and 22 for SFTP.
Most control panels have a section for creating these accounts, and creating a separate one rather than using your main hosting login is worth doing.
Separate accounts, scoped to a folder
The practical security measure most people skip.
Rather than giving a developer your main hosting credentials, create an account limited to the folder they need. They can do their work, they cannot reach your email or your databases, and when the engagement ends you delete one account rather than changing a password everything else uses.
This takes two minutes and it is the difference between granting access to a room and handing over the whole building.
The mistakes worth avoiding
- Saving passwords in the client without a master password, since some store them in plain text where anything on your computer can read them.
- Uploading to the wrong folder. Placing files above the web root makes them invisible; placing a site inside an extra folder makes it appear at the wrong address.
- Overwriting without a copy. There is no undo. Download the existing version first.
- Leaving old accounts active after a developer or employee has moved on.
- Transferring in the wrong mode, which can corrupt images and archives. Modern clients handle this automatically and it is worth knowing when something arrives broken.
What most owners actually need
To know it exists, to have the credentials recorded somewhere findable, and to use SFTP when they do use it.
Beyond occasional bulk uploads and taking a full copy of the site, most small business owners will use the control panel for everything. Having the details available for the day a developer asks for them, in the same document that holds your domain and hosting information, is the useful preparation.
Frequently asked questions
What is FTP used for?
Moving files between your computer and your web server, in either direction. It is the right tool for many files at once and unnecessary for small edits.
What is the difference between FTP and SFTP?
Plain FTP sends your username, password, and files unencrypted. SFTP runs over a secure connection and is the sensible default wherever the host supports it.
Do I need an FTP client?
Only for bulk transfers, downloading a full copy of your site, or a host migration. For editing one file or checking whether something exists, the hosting file manager is faster.
What details do I need to connect?
Host address, username, password, and port. Port 21 for FTP and FTPS, port 22 for SFTP. All four come from your hosting control panel.
Should I give a developer my hosting login?
Better to create a separate account limited to the folder they need. They can work, they cannot reach your email or databases, and ending the engagement means deleting one account.
What is the most common FTP mistake?
Uploading to the wrong folder. Files placed above the web root are invisible, and a site placed inside an extra folder appears at the wrong address.
West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.
Not sure how to get files onto your own server?
We set up scoped access properly, so contractors reach only what they need and nothing is left open afterwards.
Start a Conversation