Guide

Configure an SFTP connection

SFTP is the SSH file protocol. It is not FTP with TLS.

DiagramA session path. This page does not open it.

Your PCFile client on Windows

SSHPort 22 · host key checked here

SFTPFile subsystem, not the website

DirectoryExample: /var/www/html

Encryption is the tunnel. The host key tells you which server is at the far end. The directory is a separate choice after login.

The situation

The server offers SFTP, or you run an SSH host with the file subsystem enabled. You need a remote listing over SSH.

Prerequisites

Subsystem SSH answering on port 22 is not proof that SFTP is enabled.
Account A password or a public key already installed for that username.
Host key The fingerprint, from a channel you already trust.

Configure the session

File protocol Set SFTP. The port becomes 22 unless you override it.
Hostname and username Leave the password empty when you use a key, and do not store it with the site unless you accept that.
Key file On Advanced Site Settings → Authentication, set Private key file to the .ppk. That page exists for SFTP and SCP. Details are in the key guide.
Login Compare the host key fingerprint before you continue. The client remembers a key you accept.
Directory Open the path you were assigned.

SCP uses the same port and the same Authentication page. Use it only when SFTP is unavailable. Listings then depend on a shell, resume is not supported, and canceling a transfer ends the session. Select SFTP on purpose when the server has it. The product can fall back from SFTP to SCP, which is not a reason to standardize on SCP.

Example settings

File protocol: SFTP
Hostname: files.example.com
Port: 22
Username: example-user
Private key file: C:\Users\example-user\Keys\site.ppk

The private key stays on your PC. Do not upload it or paste it here.

Expected result

You see the account’s home directory, or the folder you opened. A later connection should not ask about the host key again unless the key changed or the saved data was removed.

Common mistakes

Selecting FTP and then TLS because the note said “secure.”
Pointing Private key file at the public key. The client uses PuTTY format and can offer to convert a recognized OpenSSH or ssh.com file.
Ignoring a host-key mismatch to save time.

Security

SSH encrypts the password and the files. The host key identifies the server. Your key pair, if you use one, identifies you. Leave agent forwarding and Kerberos delegation off unless you intend the remote host to reuse your credentials.

Troubleshooting

A timeout or refusal is before authentication. An authentication error means the socket worked. If login succeeds and SFTP then fails to start, ask whether the subsystem is enabled. Do not switch to plain FTP as a repair. See the error finder.

Winsaip is an independent educational resource and is not affiliated with or endorsed by the developers of WinSCP.