SFTP and SCP move files between your computer and your hosting account over an encrypted SSH connection, using a single port and your SSH key or cPanel password. This guide explains how to transfer files securely with SFTP and SCP -- in FileZilla, WinSCP and Cyberduck, and from the command line on Windows, Mac and Linux -- with copy-and-paste examples and fixes for the errors people hit.
SFTP, SCP and FTPS: what's the difference?
All three encrypt your password and files. They differ in how they connect and who can use them:
| SFTP | SCP | FTPS | |
|---|---|---|---|
| What it is | File transfer over SSH, with browsing, renaming and deleting | A simple "copy this file there" command over SSH | Classic FTP with TLS encryption added |
| Port | 22 | 22 | 21, plus extra data connections |
| Who can log in | Your main cPanel username | Your main cPanel username | cPanel username or any FTP account you create |
| SSH keys | Yes | Yes | No |
| Needs shell access | Yes | Yes | No |
| Best for | Everyday uploads with a program like FileZilla or WinSCP | Quick one-off copies and scripts | Giving a designer or developer access to just one folder |
SFTP is not "FTP with an S" -- it's a completely different protocol that runs inside SSH. Because it uses one port, it works through firewalls and routers that break ordinary FTP's data connections, so you won't see "Failed to retrieve directory listing".
The trade-off: SFTP and SCP always log in as your main cPanel user, with access to your whole account. To give someone limited access to one folder, create an FTP account for them and have them use FTPS instead (see the FileZilla FTPS guide in the related links).
What you need
- Shell (SSH) access on your account. If Advanced > Terminal isn't in cPanel, or SSH logins are refused with the correct password, open a ticket and ask.
- Host: your domain (for example
example.com) orsecure.instantaccess.net. - Port: 22.
- Username: your cPanel username, from General Information on the cPanel home page.
- Password or key: your cPanel password, or better, an SSH key you've authorized in Security > SSH Access > Manage SSH Keys.
When you connect you land in your home directory, /home/username. Your website lives in public_html inside it. Everything else there -- mail, etc, .ssh and so on -- is account data, so be careful not to move or delete it.
How to use SFTP in FileZilla
- Open FileZilla and go to File > Site Manager.
- Click New site and name it, for example "My website (SFTP)".
- Set Protocol to SFTP - SSH File Transfer Protocol.
- In Host, enter your domain or
secure.instantaccess.net. Set Port to22. - Choose a Logon Type:
- Normal or Ask for password -- enter your cPanel username and password.
- Key file -- enter your cPanel username and browse to your private key (for example
id_ed25519). If FileZilla offers to convert the key to its own format, click Yes and save the converted copy somewhere private.
- Optional: on the Advanced tab, set Default remote directory to
/home/username/public_html. - Click Connect.
The first time, FileZilla shows an Unknown host key window with the server's fingerprint. Tick Always trust this host, add this key to the cache and click OK. You won't see it again unless the server's key changes.
How to use SFTP in WinSCP (Windows)
- Open WinSCP. The Login window appears.
- Set File protocol to SFTP, Host name to your domain, Port number to
22, and enter your cPanel User name. - To use a key, click Advanced, go to SSH > Authentication and choose your private key file. WinSCP will offer to convert an OpenSSH key to PuTTY's
.ppkformat; accept it. - Click Save to keep the settings, then Login. Accept the host key the first time.
WinSCP shows your computer on the left and the server on the right, like FileZilla. Its Synchronize command can compare a local folder with public_html and upload only what changed.
How to use SFTP in Cyberduck (Mac and Windows)
- Click Open Connection.
- Choose SFTP (SSH File Transfer Protocol) from the menu at the top.
- Enter your domain as Server, port
22, and your cPanel Username. Enter your password, or choose your key under SSH Private Key. - Click Connect and allow the host key the first time.
Using SFTP from the command line
Windows 10 and 11, macOS and Linux all include the sftp command. Open Terminal or PowerShell and connect:
sftp username@example.comYou get an sftp> prompt. Commands without an l act on the server; commands starting with l act on your own computer:
| Command | What it does |
|---|---|
pwd / lpwd | Show the current folder on the server / on your computer |
ls / lls | List files on the server / on your computer |
cd public_html | Change folder on the server |
lcd Downloads | Change folder on your computer |
put index.html | Upload a file |
put -r images | Upload a folder and everything in it |
get wp-config.php | Download a file |
get -r uploads | Download a folder |
mkdir newfolder / rm oldfile.txt | Create a folder / delete a file on the server |
exit | Disconnect |
Example: download your WordPress configuration file to your computer for safekeeping.
sftp username@example.com
sftp> cd public_html
sftp> lcd Desktop
sftp> get wp-config.php
sftp> exitUsing SCP for quick copies
scp works like the ordinary copy command, but one side is on the server. The pattern is always scp FROM TO, and the server side is written username@example.com:path. Paths without a leading / start in your home directory.
Upload a file
scp site-backup.zip username@example.com:public_html/Download a file
scp username@example.com:public_html/.htaccess .The . at the end means "the folder I'm in now" on your computer.
Copy a whole folder
scp -r ./my-theme username@example.com:public_html/wp-content/themes/Use a specific key
scp -i ~/.ssh/id_ed25519_hosting report.pdf username@example.com:public_html/files/Watch the capital letter: scp uses -P (capital) for a port number, while ssh uses -p. You won't normally need either, because we use the standard port 22.
On Windows, put paths that contain spaces in quotes, for example scp "C:\Users\Pat\My Site\index.html" username@example.com:public_html/.
Tips for moving whole websites
- Zip first. Thousands of small files (a typical WordPress site) transfer slowly one by one. Compress the folder into one archive, transfer it, then extract it. On the server, in Advanced > Terminal:
Then downloadcd ~/public_html zip -r ~/site-copy.zip .site-copy.zipfrom your home directory, and delete it from the server afterwards so it doesn't use your disk space. You can also use Compress in File Manager. - Keep the file layout. Upload into the right folder -- your site's files go directly inside
public_html, not inpublic_html/public_htmlorpublic_html/mysite. - Check permissions afterwards. Files should normally be
644and folders755. Files copied from a Mac or Linux computer withscp -pkeep their original permissions, which may not be what the web server needs.
Troubleshooting
"Permission denied (publickey,password)" or "Authentication failed"
Check you're using your cPanel username, not an FTP account such as designer@example.com (FTP accounts can't use SFTP). If you use a key, make sure it's authorized in Manage SSH Keys. Our SSH errors guide covers every variation of this message.
FileZilla: "Connection timed out after 20 seconds of inactivity" or "Could not connect to server"
Check the protocol is SFTP and the port is 22. A common mistake is choosing SFTP but leaving port 21, or choosing FTP with port 22. If the settings are right, your IP address may be blocked after failed logins -- stop retrying, get your IP from whatismyipaddress.com and open a ticket.
"FATAL ERROR: Remote side unexpectedly closed network connection" or "Server unexpectedly closed network connection"
Your account may not have shell access, or your IP may have been blocked mid-session. Try Advanced > Terminal in cPanel: if that works, open a ticket with your IP address.
"scp: /home/username/public_html/file: Permission denied"
You're trying to write somewhere your account can't, or over a file with read-only permissions. Check the path and the file's permissions in File Manager.
"No such file or directory"
Check the path on both sides. Remember that server paths are case-sensitive: Images and images are different folders.
Uploaded files don't show on the website
Make sure they went into public_html (or your subdomain's folder), then clear your browser cache and purge LiteSpeed Cache if you use it.
Common questions
Can I give my web designer SFTP access to just one folder?
Not with SFTP, which always gives access to the whole account. Create an FTP account limited to that folder and have them connect with FTPS instead. It's just as secure in transit.
Is SFTP faster than FTP?
Usually about the same. For big transfers, sending one zip file is far faster than thousands of small files, whichever protocol you use.
Do I need to install anything on Windows?
Not for command-line sftp and scp on Windows 10 and 11 -- they're built in. For a point-and-click program, install FileZilla, WinSCP or Cyberduck from their official websites.
Where do I download a full backup instead?
Use JetBackup 5 in cPanel, which packages your files, databases and email for download.
Related guides
- How to Connect to Your Website with FileZilla (FTPS)
- How to Create an FTP Account in cPanel
- How to Use SSH, SSH Keys and Terminal in cPanel
- File and Folder Permissions Explained (644 and 755)
- How to Download a Copy of Your Website Backup (JetBackup 5)
Still stuck? Open a support ticket and the Instant Access Internet Services team will help.
