Use SFTP when you only need to upload, download, or organize website files. Use SSH when the job requires a command shell, deployment scripts, logs, permissions, services, databases, or other server administration. SFTP is the SSH File Transfer Protocol: in OpenSSH it runs as the sftp-server subsystem over an encrypted SSH connection. SSH is the broader protocol that can provide interactive login, remote commands, and network forwarding.
SSH and SFTP at a glance
These technologies are related, but they are not interchangeable names for the same capability. SSH defines a secure transport and connection system for remote services. SFTP is one file-management service carried through that system.
As an Amazon Associate I earn from qualifying purchases.
| Decision axis | SSH | SFTP |
|---|---|---|
| Main purpose | Secure remote login, command execution, administration, and network forwarding | Secure remote file transfer and file management |
| Typical interface | Interactive shell, one-off commands, scripts, and forwarded connections | Graphical or command-line file-transfer client, batch jobs, and file-management commands |
| Website tasks | Run deployment tools, inspect logs, change permissions, restart services, install dependencies, or execute database and build commands | Upload and download files, create directories, rename items, remove files, and synchronize site content |
| Possible access scope | Broad server control when the account has those privileges | Can be limited to file operations and a specific directory or chroot |
| Best least-privilege default | Use only when the task actually needs shell or server control | Prefer for file-only access |
The final scope is not determined by the acronym alone. The hosting provider’s account policy, directory permissions, authentication settings, and service configuration decide what a particular login can do.
What SSH is
The IETF defines SSH as a protocol for secure remote login and other secure network services across an insecure network. RFC 4251 describes three layers:
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Transport: authenticates the server and provides confidentiality and integrity, with optional compression.
- User authentication: verifies the person or service account using methods allowed by the server, such as a password or public key.
- Connection: multiplexes separate channels inside one encrypted tunnel.
RFC 4254 specifies the connection features most relevant to web administrators: interactive login sessions, remote command execution, forwarded TCP/IP connections, and forwarded X11 connections. A single SSH connection can therefore carry a shell, a one-off command, or a forwarded service, subject to authorization.
OpenSSH is a widely used implementation suite rather than a different protocol. Its client-side tools include ssh, scp, and sftp. Server-side components include sshd and sftp-server; key utilities include ssh-keygen, ssh-add, and ssh-keyscan. OpenSSH also documents public-key authentication, agent forwarding, tunneling, and optional compression.
For a website, SSH matters whenever the work is more than moving bytes. A deployment might need to install dependencies, run a build, clear a cache, execute a migration, inspect an error log, adjust ownership, or restart a process. Those are command and administration functions, not file-transfer functions.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteWhat SFTP is
SFTP stands for SSH File Transfer Protocol. In OpenSSH, the sftp client asks sshd to start the sftp-server subsystem. The file-transfer program then performs its operations over the encrypted SSH transport and can use the same public-key authentication and optional compression described for SSH.
The interface resembles FTP in purpose, but it is not the old FTP protocol protected by an add-on encryption layer. SFTP has its own file-operation protocol and relies on SSH for transport security and authentication. Typical operations include listing directories, uploading and downloading, creating directories, renaming entries, and deleting or synchronizing content, within the account’s permissions.
A server can configure an account for SFTP-only access. Such an account may be confined to a directory or chroot and may have no interactive shell at all. That arrangement is useful when a contractor, editor, or automated publishing job needs website files but should not be able to run arbitrary server commands.
Rank #2
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How SFTP and SSH relate on a server
When you connect with SFTP, you normally connect to the SSH service and request its SFTP subsystem. OpenSSH documents sftp-server as a subsystem started by sshd; Microsoft likewise describes SFTP as running over SSH. The encryption and account authentication are therefore supplied by SSH, while the available operations are defined by SFTP.
Free tools Windows power users keep installed
One-click scans. No signup required.
The port is a configuration choice. Many deployments use the same port configured for the SSH service, but an administrator can select a custom port. Do not assume a universal port number: obtain the hostname, port, username, authentication method, and starting directory from the host.
Because both clients use SSH transport, host-key verification and account policy matter for each. A successful SSH login does not prove that the account should have unrestricted shell access, and an SFTP login does not imply that shell commands will work. The server decides whether the account receives a shell, the SFTP subsystem, or a restricted variant.
Which protocol fits a website task?
Choose SFTP for file-only publishing
SFTP is the focused option when the change consists of moving or organizing files. Examples include uploading a theme or static asset, replacing an image, downloading a backup file, creating an uploads directory, renaming a release folder, or synchronizing a local site tree with the server.
It gives the operator a file-management interface without requiring a general-purpose command shell. That narrower exposure is a least-privilege advantage, provided the account is actually configured with a restricted directory and suitable permissions.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Choose SSH when the job needs commands
Use SSH when you must run deployment scripts, inspect logs, change ownership or permissions, restart services, install packages or dependencies, invoke a server-side build, execute database commands, or manage a running process. SFTP can place the files needed for those tasks, but it cannot replace the command channel that performs them.
Use both for a controlled deployment
A common workflow is to transfer a release archive or build output with SFTP, then connect with SSH to verify it, run the required deployment command, adjust a symlink or permission, and check logs. Whether this is allowed depends on the account and provider policy; a file-only SFTP account will not be able to perform the second stage.
Is SFTP safer than SSH?
Both rely on SSH encryption and authentication when implemented through OpenSSH. “Safer” therefore does not mean that SFTP uses stronger cryptography. The practical difference is exposed capability.
- An unrestricted SSH account may expose a shell, command execution, and forwarding in addition to files.
- An SFTP-only account can be limited to file operations and a designated directory.
- Either account can still be dangerous if its directory permissions, keys, passwords, or host configuration are weak.
The least-privilege recommendation follows from that capability difference: grant SFTP for a person or process that only publishes files, and grant SSH only where command or administration access is required. Ask the host whether it supports SFTP-only accounts, chroot directories, key authentication, custom ports, and restrictions on available commands.
How to request and set up SFTP-only website access
Hosting interfaces differ, so the exact labels will vary. The security decisions are consistent. Confirm each item with the provider before handing over credentials.
- Define the required directory. Identify the document root or release directory the user or deployment job must modify. Do not grant an entire server filesystem when a site directory is sufficient.
- Ask for an SFTP-only account. Request that the account receive the SFTP subsystem without an interactive shell, if the provider supports that policy.
- Request a chroot or equivalent directory boundary. A chroot can make the permitted directory appear as the account’s filesystem root. Verify which subdirectories are writable and where the account starts after login.
- Use public-key authentication where available. Generate a key pair with the provider’s supported utility, protect the private key locally, and supply only the public key. The server’s accepted authentication methods remain subject to its policy.
- Record the connection details. Obtain the hostname, configured port, username, authentication method, and remote starting path. A custom port is normal; do not infer it from another account.
- Verify the host key on first connection. Compare the fingerprint through a trusted provider channel before accepting it. This helps detect an unexpected server or interception.
- Test the boundary. Confirm that the account can create, replace, and remove only the intended files, and confirm that an attempted shell login is denied if the account is supposed to be SFTP-only.
Keep private keys out of shared folders and build artifacts. Remove access when a person or automation job no longer needs it, and review directory permissions separately from the transport settings.
Basic SFTP workflow for a website
A graphical client can hide the protocol details, while the command-line client makes them explicit. The following generic workflow applies to either style; replace the values with the host’s actual settings.
- Connect with the supplied account. A command-line connection follows the form
sftp -P <port> <user>@<host>. If the provider uses the SSH service’s standard configured port, the port option may be unnecessary; do not assume a number without confirmation. - Check the remote starting directory. List its contents and identify the directory that contains the live site or the provider’s release structure. A chrooted account may show a path different from the server administrator’s path.
- Upload to a staging or release location when available. Transfer the complete set of files, rather than overwriting a live tree one file at a time, if the hosting layout supports atomic releases.
- Set local and remote locations deliberately. Keep track of which pane or command operates on your computer and which operates on the server. An accidental recursive upload can overwrite unrelated content.
- Verify the transfer. Check names, sizes, and timestamps, and use the client’s comparison or synchronization feature where available. A successful transfer reports delivery, not application correctness.
- Apply only permitted file operations. Renaming, deleting, or changing permissions may be restricted. If the site needs an ownership change or a service reload, stop the SFTP session and use an authorized administrative path instead.
For repeatable publishing, keep a manifest or versioned release directory so that a failed upload can be identified and rolled back. The exact rollback mechanism belongs to the host’s deployment design, not to SFTP itself.
Using SSH for deployment and administration
SSH is appropriate when the server must do work after the files arrive. A cautious session usually follows this order:
- Verify the host and account. Connect with the provider’s hostname, port, and approved key or password. Confirm the host key before entering credentials.
- Check your current identity and directory. Confirm which account you are using and which release or site directory is active. This prevents commands from being run against the wrong virtual host.
- Inspect before changing. Review the deployment files, available disk space, relevant logs, and the current service state. Use read-only checks first.
- Run the smallest required command set. Execute the documented build, migration, cache, permission, or service command. Avoid copying a command intended for a different operating system or hosting layout.
- Validate the result. Check the process or service status, inspect the relevant log output, and make a test request to the site if your operating procedure allows it.
- Close the session and rotate access when necessary. Do not leave private keys or temporary credentials on the server. Remove temporary administrative access after an emergency change.
SSH forwarding and agent forwarding are additional capabilities, not requirements for ordinary website publishing. Enable them only when a documented workflow needs them, because each expands what an authenticated session could reach.
Can you use SSH without giving shell access?
SSH is the transport and connection framework; a server does not have to grant every SSH user an unrestricted interactive shell. An administrator can expose the SFTP subsystem and restrict the account to a directory, while denying normal shell use. Other controlled SSH arrangements may permit a narrowly defined command, but the exact mechanism and available restrictions depend on the server implementation and provider policy.
For a website operator, the practical test is capability, not the label on the account: ask whether the login can start a shell, execute arbitrary commands, forward connections, or access files outside the intended directory. Do not assume that an account called “SSH” is unrestricted or that an account called “SFTP” has no other privileges without checking its configuration.
SFTP, SCP, and the OpenSSH 9.0 change
SCP is a separate OpenSSH client name that has historically been associated with the legacy scp/rcp transfer protocol. OpenSSH release notes state that OpenSSH 9.0 changed scp to use SFTP by default instead of that legacy protocol.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
This matters for deployment scripts. Legacy scp behavior, especially wildcard expansion and other path-handling details, may not match SFTP behavior. Before changing an OpenSSH version or replacing a command, review scripts that depend on those semantics and test them against a non-production destination. Choosing SFTP directly makes the intended file-transfer protocol explicit.
Website and WordPress-specific decisions
Editing themes, plugins, and media
If the change is limited to uploading a theme package, replacing a plugin file, or moving media, an SFTP account scoped to the site directory is generally the better operational fit. Keep a backup and verify that the uploaded files have the ownership and permissions expected by the web server; if they do not, an administrator may need to correct them through an authorized command channel.
Running updates and migrations
Updates that invoke a package manager, database migration, cache rebuild, queue worker, or service restart need command execution. Use an appropriately restricted SSH account or the hosting provider’s deployment interface rather than trying to accomplish those steps through SFTP.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteInvestigating an outage
Reading logs, checking processes, examining disk usage, and restarting a service are SSH or provider-console tasks. A file-transfer login may let you retrieve a log file if permissions allow, but it cannot provide the broader diagnostic context of a shell session.
Separating human and automation access
Give a publishing job an SFTP-only identity when it only transfers built files. Give a deployment runner a separate, narrowly authorized SSH identity when it must execute commands. Separate keys and accounts make it possible to revoke one workflow without disabling the other and produce clearer audit records.
Security checklist
- Use public-key authentication where the host supports it, and protect private keys with a strong local control.
- Verify the server host key before the first trusted connection and investigate unexpected changes.
- Grant the smallest directory scope and command capability that completes the task.
- Prefer an SFTP-only account for file-only publishing; do not hand out shell access merely because an upload tool can use it.
- Ask whether a chroot or equivalent directory restriction is active and test it.
- Confirm the configured port instead of assuming a default.
- Keep human and automated credentials separate, and revoke unused keys promptly.
- Review scripts after an OpenSSH upgrade, especially those that relied on legacy
scpwildcard behavior. - Record which account performed a deployment and retain the relevant transfer or command logs.
Troubleshooting common connection and access problems
| Symptom | Likely explanation | What to check |
|---|---|---|
| Connection refused or timed out | Wrong hostname or port, a firewall rule, or a provider-side service restriction | Confirm the exact SFTP/SSH endpoint and configured port with the host; do not substitute a port from another server |
| Authentication fails | Wrong username, disabled method, incorrect key, or an account-policy mismatch | Verify the username and accepted authentication method; ensure the public key is installed and the private key is the matching one |
| SFTP works but shell login is denied | The account is intentionally SFTP-only | Use SFTP for file operations or request a separately authorized SSH account for commands |
| Login succeeds but the expected files are missing | A chroot or different starting directory changes the visible path | List the remote root and ask the provider for the site’s path inside the account boundary |
| Upload completes but the website shows an error | Wrong release directory, ownership or permission issue, missing build step, cache, or service state | Verify the deployed path; use authorized SSH or the provider console to inspect logs, permissions, processes, and required post-deploy commands |
| A script behaves differently after an OpenSSH upgrade | scp now uses SFTP by default in OpenSSH 9.0 and later |
Review wildcard and path assumptions, then test the script with an explicit, supported command |
Questions to ask your hosting provider
- What hostname and port should SFTP use, and is that port shared with SSH?
- Can you create an SFTP-only account with no interactive shell?
- Can the account be confined to the website’s document root or a chroot directory?
- Which public-key formats and authentication methods are accepted?
- What remote path is visible after login, and which directories are writable?
- Are file ownership, permissions, symlinks, and atomic release directories supported?
- Which commands, if any, are available through an SSH account, and are forwarding features disabled?
- How should host-key fingerprints be verified, and where are transfer and login events recorded?
The practical decision
For a website editor who needs to move files, request SFTP credentials and insist on the narrowest directory scope that works. For a developer or administrator who must run deployment and maintenance commands, request SSH access with only the required privileges. In larger workflows, use separate SFTP and SSH identities so that transferring a build does not automatically grant the ability to control the server.
If you need a self-managed Linux VPS for these SSH-based deployment tasks, Antihost VPS provides full root access on AMD Ryzen 9 9950X3D with NVMe storage in the USA East, Netherlands, and Ukraine.
Recommended Free Tools
Remember the relationship: SFTP is not a competing encryption system or a replacement for SSH. It is a file-transfer subsystem carried through SSH. The secure transport may be shared, but the account’s exposed operations, directory boundary, port, and authentication policy are configuration decisions that should be verified with the host.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
