FTP - File Transfer Protocol - was designed in 1971. Security was not a priority in 1971. When you connect to your web server using plain FTP, your username, password, and every file you transfer are sent across the network in cleartext. Anyone positioned between your computer and the server - whether on a coffee shop Wi-Fi network, a hotel connection, or anywhere along the route - can read all of it with freely available tools.
This is not a theoretical risk. FTP credential theft is one of the most common ways websites get compromised. An attacker gets your FTP password, logs in, and plants malware in your theme or plugin files. Your site looks normal to you, but it is serving malware to your visitors.
SFTP fixes this. It is time to stop using FTP entirely.
What Makes SFTP Secure
SFTP stands for SSH File Transfer Protocol. It runs over an SSH (Secure Shell) connection, which means every byte transferred - including your credentials - is encrypted end-to-end. Even if someone intercepts the traffic, they see encrypted noise.
Despite the similar name, SFTP is not FTP with encryption bolted on (that would be FTPS, which is a different protocol). SFTP is an entirely separate protocol built on SSH from the ground up. It uses port 22 by default instead of port 21.
Enabling SFTP on Your Hosting Account
On a cPanel hosting account with dotCanada, SSH access (and therefore SFTP) can be enabled from your cPanel dashboard. Look for SSH Access under the Security section. From there you can enable SSH access for your account and manage SSH keys.
If SSH access is disabled on your plan, contact support to have it enabled. On shared hosting, SSH access is typically available on all standard plans.
Configuring FileZilla for SFTP
FileZilla is the most widely used free FTP client, and it supports SFTP natively. Here is how to connect securely:
- Open FileZilla and go to File > Site Manager
- Click New Site and give it a name
- Set the Protocol dropdown to SFTP - SSH File Transfer Protocol
- Enter your Host (your domain or server hostname)
- Set Port to 22
- Set Logon Type to Normal
- Enter your cPanel Username and Password
- Click Connect
That is it. Everything looks and works exactly the same as FTP, but your connection is now encrypted. There is no reason not to make this switch today.
SSH Key Authentication: Even More Secure
Password authentication over SFTP is secure against network interception, but passwords can still be guessed or phished. SSH key authentication eliminates the password entirely.
With key authentication, you generate a key pair on your computer - a private key that stays on your machine and a public key that you upload to your server. When you connect, the server challenges your client to prove it has the private key without actually sending it. No password travels across the network at all.
To set this up in cPanel, go to SSH Access > Manage SSH Keys > Generate a New Key. Download the private key, import it into FileZilla under Edit > Settings > SFTP, and set your FileZilla logon type to Key file.
Why You Should Never Use FTP Again
Plain FTP has no place in modern website management. The risks are real, the fix is free and takes five minutes, and SFTP works identically from a day-to-day standpoint. The only reason to use FTP is if your hosting provider genuinely does not support SFTP - and that would be a sign to switch providers.
This matters most when you are on a shared network. Working from a home office on a private connection with a router you control is lower risk than working from a café, an airport, a hotel, or any other shared Wi-Fi. But the correct answer is not to assess the risk each time - it is to use SFTP everywhere, always, so you never have to think about it.
Make the switch in FileZilla today. It is a five-minute change that permanently closes a meaningful security gap.
