On this page
FTP, SFTP, and File Manager are three ways to move files on your hosting account. FTP sends login details in plain text, SFTP encrypts the same work over SSH on port 22, and File Manager runs inside cPanel over HTTPS. For day-to-day uploads from a desktop tool, prefer SFTP. Use File Manager for a quick one-off change, and treat plain FTP as a last resort for older software that cannot speak anything else.
What each option actually does
FTP is the older file-transfer protocol. It does not encrypt passwords or file contents, so a shared network can expose them. SFTP is a different protocol that rides on SSH, so your session stays encrypted end to end. File Manager is the browser tool in cPanel; it never needs a separate FTP client because you are already logged into the control panel over HTTPS.
cPanel still offers FTP because some design tools only speak that protocol. FTPS is a third approach that wraps FTP in TLS, and it is often fussier with firewalls than SFTP. When you have a choice, pick SFTP on port 22. AutoSSL and Let’s Encrypt protect the File Manager session the same way they protect the rest of cPanel.
How to connect with SFTP
In FileZilla or a similar client, set the protocol to SFTP before you connect. People often leave it on FTP by mistake and then send passwords in the clear. Use the cPanel username or an FTP account you created, plus the server hostname from your welcome email. Do not use the domain name if DNS still points at a previous host.
sftp [email protected]An SSH key on the main account user is stronger than a password-only FTP login. Keep the home directory of any extra user limited to the folder they need. A user whose home is set to / can see mail folders, tmp data, and other sites on the same account, which you should avoid.
Contractors, quotas, and everyday file work
If a vendor must upload files, create an FTP or SFTP user that can see only one directory, then delete that user when the job ends. Do not leave the account open for a later project. Disk usage from those users still counts against the main account quota. Mail and backups live outside public_html, so a jailed web folder does not expose them by default.
File Manager is fine when you need to replace one file or check a path. Larger deploys work better over SFTP or Git. Edit .htaccess in a tool that saves plain text, so the file does not pick up the wrong encoding. On shared hosting you have cPanel without root, which is enough for these workflows; you do not need server-level access to move site files safely.
A simple rule of thumb
Use SFTP for regular transfers from your computer. Use File Manager for small fixes in the browser. Reach for plain FTP only when software cannot do SFTP, and lock that login down to one folder. Prefer keys over passwords when your client supports them, and rotate or remove temporary users as soon as the work is finished.
Tagged
Was this article helpful?
Be the first to rate this article.
