Skip to main content

Upload website files with SFTP

To put a website online, its files need to be copied from your computer to your hosting account. The usual tool for that is a file transfer app that speaks SFTP or FTPS. This guide explains the difference between the transfer methods, how to connect, where your website files belong and which file permissions to use.

SFTP, FTPS and FTP​

All three let you copy files between your computer and a server, but they handle security differently.

MethodWhat it isEncryptedUsual port
SFTPSSH File Transfer Protocol, which runs over an SSH connectionYes22
FTPSClassic FTP with a TLS layer added, the same encryption used by HTTPSYes21 (explicit)
FTPFile Transfer Protocol, the original methodNo21

Use SFTP or FTPS whenever your host offers them. Plain FTP sends your username, password and files across the internet unencrypted, so anyone able to watch the traffic on the way, for example on a public Wi-Fi network, can read them.

Despite the similar names, SFTP and FTPS are different protocols. Your host tells you which ones it supports and which port to use.

Connect to your hosting​

The screens differ between apps, but every app asks for the same details.

  1. Open your file transfer app and start a new connection or site entry.
  2. Choose SFTP as the protocol, or FTPS (sometimes shown as "FTP with explicit TLS") if that is what your host provides.
  3. Enter the host, for example sftp.example.com or 203.0.113.15.
  4. Enter the port: 22 for SFTP, unless your host gives you a different number.
  5. Enter your username and either your password or the path to your private SSH key file.
  6. Connect. The first time you connect over SFTP, the app shows the server's host key fingerprint, a unique code that identifies the server. Accept it if it matches the one your host published, or if you are confident you typed the right host.

Once connected, most apps show your computer's files on one side and the server's files on the other.

Saved passwords

Many file transfer apps can save your password. Only save it on a computer that you alone use and that is protected by a sign-in password. Using an SSH key instead of a password is more secure, see Connect to your server with SSH for how keys work.

Find the document root​

The document root is the folder on the server that visitors see when they open your domain. A file named index.html or index.php in that folder is your home page.

Its name depends on the host and the server setup. Common names include public_html, htdocs, www and web, and an extra domain or subdomain often has a folder of its own. Check your hosting account for the exact folder before you upload. Files placed anywhere else are not shown to visitors, which is a common reason for a 404 error after an upload.

Upload your site​

  1. On the server side, open the document root.
  2. On your computer's side, open the folder that contains your website files. Upload the contents of that folder, not the folder itself, so that index.html or index.php lands directly inside the document root.
  3. Drag the files across, or select them and choose Upload.
  4. Wait for the transfer queue to finish and check it for failed files. Retry any that failed.
  5. Open your domain in a private browser window to check the result.
Overwriting files

Uploading a file with the same name as one on the server replaces it, and there is no undo. Download a copy of the existing files, or take a backup, before you upload over a working site.

Hidden files, whose names start with a dot such as .htaccess, are easy to miss. Many apps hide them by default; look for a "show hidden files" option if you need to upload or edit one.

File permissions​

On Linux servers, each file and folder has permissions that decide who may read, change or run it. They are often written as three digits: the first is for the owner (your account), the second for its group, and the third for everyone else.

ItemTypical settingMeaning
Files644You can read and write; others can only read
Folders755You can read, write and open; others can read and open
Configuration files with passwords600 or 640Readable only by you (and, with 640, your group)

Some hosts need slightly different values, so follow your host's guidance if it differs. Most file transfer apps let you change permissions by right-clicking a file and choosing File permissions or Properties.

Never use 777

A permission of 777 lets anyone on the server change the file or folder. It is a common way for sites to be hacked. If an app or plugin seems to need it, the real cause is usually the wrong file owner, so ask your host instead.

Did this article help you?