Can't connect with SFTP or FTP
File transfer apps such as FileZilla, WinSCP or Cyberduck connect to your hosting account so you can upload and download website files. When the connection fails, the error message usually points to one of a few causes. This guide is for anyone who cannot connect with SFTP or FTP, and works through the checks in order.
Read the error message
| What the app says | Likely cause | Where to look |
|---|---|---|
| "Connection refused" | Wrong port or protocol, or the service is not available on that address | Host, protocol and port |
| "Connection timed out" or "could not connect to server" | Wrong host, a firewall in the way, or your IP address is blocked | Network and blocks |
| "Authentication failed", "access denied" or "530 Login incorrect" | Wrong username or password | Username and password |
| Connects, but the folder list never appears | Passive mode problem (FTP only) | Passive mode |
| "Host key has changed" or "server's host key does not match" | The server's identity is different from last time | Host key warnings |
Check the host, protocol and port
Host. Use the server name or IP address your host gave you for file transfer, for example server.example.com or 203.0.113.25. Your own domain, such as example.com, only works if its DNS points to the same server. If you recently moved the domain to new hosting, it may now lead to a different server.
Protocol. There are three different protocols, and they are not interchangeable:
| Protocol | What it is | Usual port |
|---|---|---|
| SFTP | File transfer over SSH, fully encrypted. The safest choice. | 22, though hosts often use another port |
| FTPS | Classic FTP with TLS encryption added | 21 (explicit) or 990 (implicit) |
| FTP | The original protocol, with no encryption | 21 |
In your app, choose the protocol your host supports, rather than letting it guess. Choosing FTP when the server expects SFTP, or the other way round, often gives "connection refused" or an error about an unexpected reply.
Port. Enter the exact port your host gives you. Hosts sometimes run SFTP on a port other than 22, and the app will not find it otherwise.
Check the username and password
- Username format. Some hosts use a short account name such as
exampleuser; others use a full form such asjane@example.com. Copy it exactly as your host shows it. - Password. Type it again rather than relying on a saved one, and check for spaces copied at the start or end. If you reset your hosting password recently, the file transfer password may or may not have changed with it.
- The right account. Many hosts let you create extra file transfer accounts. Make sure the one you use still exists and has access to the folder you need.
- SSH keys. If your SFTP account uses a key instead of a password, make sure your app is set to use the right private key file.
Check for blocks and network problems
Blocked after failed attempts. Servers often block an IP address for a while after several failed sign-ins, to stop password guessing. Once that happens, even the correct password fails or the connection times out. Stop trying, fix the details, and wait before connecting again. If it does not clear, ask your host to check whether your IP address is blocked.
Your own network. Office firewalls, public Wi-Fi and some security software block ports used for file transfer. Try another network, such as a phone hotspot. If that works, the block is on your usual network.
VPN. A VPN changes the IP address the server sees. If your host only allows certain IP addresses, or blocked the VPN's address, turn the VPN off or ask your host about it.
FTP passive mode
Plain FTP and FTPS open a second connection for each folder listing and file transfer. In passive mode, your app opens that second connection to the server, which works through most home and office firewalls. If your app connects and signs in but hangs at "Retrieving directory listing", set the transfer mode to passive. SFTP does not have this problem, because it uses a single connection.
Host key warnings
The first time you connect with SFTP, your app shows the server's host key fingerprint, a short code that identifies the server, and remembers it. On later visits, it checks that the server shows the same key.
If the key changes, the app warns you. There are innocent reasons, such as your host moving your account to a new server or reinstalling it. But the same warning appears if someone is intercepting your connection and pretending to be the server.
Do not accept the new key just to make the warning go away. Ask your host, through a channel you already trust, whether the server changed, and compare the fingerprint they give you with the one your app shows. Accept the new key only if they match.
Still stuck?
Note the app you use, the host, protocol, port and username you entered (never the password), the exact error message and your IP address. That information makes any support request much faster to solve.
If you still cannot connect to your DomainPilot hosting account, contact DomainPilot support with the details above.