SSH vs SFTP vs FTP: What's the Difference?

What Is SSH?

SSH (Secure Shell) is a cryptographic network protocol for remote server access and management. It runs on port 22 by default and encrypts the entire session — commands, responses, file transfers, and tunneled traffic. SSH is how developers and DevOps engineers connect to and manage Linux servers from the command line.

SSH also serves as the transport layer for other tools. SFTP runs over SSH. Git over SSH uses it. Port forwarding uses it. VS Code Remote SSH uses it. When people say "set up SSH" for a server, they mean configuring the OpenSSH daemon (sshd) and creating key pairs for authentication.

What Is FTP?

FTP (File Transfer Protocol) is the original file transfer protocol, dating to 1971. It uses port 21 for control and a dynamic data port. The critical problem: FTP sends everything in plaintext — username, password, and file contents are all transmitted unencrypted. Anyone on the same network path can intercept them with a packet sniffer.

FTP should never be used over the public internet. It survives in modern infrastructure only for legacy systems, internal networks behind strict firewalls, and specific hosting control panels that haven't updated. FTPS (FTP Secure) adds TLS encryption to FTP and is a separate, more secure protocol — but SFTP is still the preferred choice for new setups because it requires no separate configuration beyond SSH.

What Is SFTP?

SFTP (SSH File Transfer Protocol) provides file transfer capabilities over an SSH connection. Same port (22), same encryption, same SSH key authentication. If SSH is available on a server, SFTP works without any additional setup.

SFTP supports upload, download, directory listing, renaming, permissions management, and symbolic links — everything needed for managing files on a remote server. SFTP replaced FTP as the standard for secure web server file access.

Side-by-Side Comparison

When to Use Which

Use SSH when you need to run commands, manage the server, restart services, or execute deployment scripts.

Use SFTP when you need interactive file management — browsing directories, uploading builds, downloading logs, or giving clients access to a specific folder via a GUI client like FileZilla or Cyberduck.

Use SCP for quick one-off file copies in scripts. Faster than SFTP for single files since it skips the interactive negotiation phase.

Use rsync over SSH for directory syncing and incremental backups: rsync -avz -e ssh ./dist/ user@server:/var/www/ — only transfers changed files.

Never use plain FTP over the public internet. Use SFTP instead — it requires no extra server configuration and is strictly more secure.

CloudStick FTP & SFTP

CloudStick provides SFTP on all plans and plain FTP on Basic and above. The Free plan is SFTP-only — a practical security benefit since there's no temptation to enable the less secure protocol. Both are configured from the FTP Access section in each website's panel, where you create users scoped to specific directories with automatic chroot.

Recommendation: use SFTP for all new integrations. Only enable plain FTP if a specific legacy tool requires it — and only on a private network or behind a VPN. CloudStick's chrooted SFTP users are the right way to give clients or contractors access to a single website without exposing the rest of the server.