FTP vs SFTP: differences and how to transfer files securely
Published on 2026-10-26 by frfrand
What is the difference between FTP, FTPS, and SFTP, how files travel, and what to choose for a Linux server.
FTP and SFTP are not versions of the same protocol with a small security change. FTP is a classic file transfer protocol; SFTP is the file transfer protocol over an SSH connection. FTPS, on the other hand, is FTP protected via TLS and is also not the same as SFTP.
A simple way to understand it
Think about sending a folder of documents by courier. One option uses an old channel with communications that may remain exposed depending on its configuration; another uses a secure and authenticated session. Although both transfer files, the rules for establishing connection, authenticating, and moving data are different.
How it works in practice
Classic FTP uses control and data connections, which can complicate firewalls and NAT. SFTP typically works through SSH, with authentication via credentials or keys depending on the server and cryptographic protection of the session. An SFTP client allows listing directories, downloading and uploading files, and operating on paths where the user has permissions.
What it does not solve and its limits
Using SFTP does not grant absolute security. If you share private keys, leave excessive permissions, or disable server verification, the transfer can still be dangerous. It is also not advisable to give a client access to the root directory just because they need to upload a file. FTPS remains useful in specific integrations, but requires understanding its differences.
How to apply it and check it without surprises
Before connecting, check the server name and identity, especially the SSH key fingerprint when applicable. Create an account with restricted access to the necessary directories and test first with a non-critical file. Check permissions when uploading website files: an executable or configuration file should not be writable by anyone.
How it appears in ArduMaker?
If you transfer files to an ArduMaker VPS via SFTP, apply separate accounts and permissions per project and avoid sharing administrative accesses. The access decision depends on the server architecture.
A real example with a real client
An agency has a website on Linux and needs its designer to upload photographs once a week. Giving them root SSH access to upload images is unnecessary. What is reasonable is to have an account with permissions over the corresponding directory, robust authentication, and change logging. Also test the behavior when it tries to write outside its authorized zone.
What happens if the connection is cut?
A transfer client may retry or resume operations depending on the program and the server. However, you should not assume that any file was complete. Check sizes and integrity if they are important files, especially backups or customer data.
To remember
FTP and SFTP are not versions of the same protocol with a small security change. Understanding when it applies, how it fails, and what data to review is more useful than memorizing isolated commands.
To expand: OpenSSH: sftp page.