FTP Clients: Which to Use, and Why You Should Use SFTP

Updated September 2026 · Written and maintained by the Progression Agency strategy team

An FTP client is a program for moving files between your computer and a web server. The honest starting point is that plain FTP is obsolete and insecure — it sends credentials in clear text — and almost everyone searching for an FTP client actually needs SFTP or FTPS, which the same programs support. This page covers which clients are worth using, what the protocol differences actually mean, and when file transfer is the wrong tool entirely.

Why FTP still exists

Almost every host still offers it, it requires no tooling, and for a single file change it remains the shortest path. What it lacks is any record of what changed, which is why anything recurring belongs in version control instead.

Colocation in Chicago, and the product enablement role

Two unrelated topics that share this page’s audience.

Colocation in Chicago is a substantial market because the city is a major network interconnection point, with a concentration of carrier-dense buildings. Chicago server colocation buyers are usually choosing on three things: which networks are available in the building, power density per rack, and how far the facility is from the users or exchanges that matter. Equinix data center Chicago facilities are among the best known, and the general principle applies to every provider — the value is the interconnection, not the floor space.

What is product enablement: making sure the people who sell and support a product actually understand it — positioning, competitive comparison, demonstration, objection handling and the material that supports each. A product enablement manager sits between product and the commercial teams, and the role exists because a feature that shipped and was never explained is indistinguishable from one that was never built.

Moving company PPC is a third topic and a difficult one: the category has high click prices, heavy lead-aggregator competition, and a customer with a fixed date who contacts several firms at once. Speed of response is the variable that decides which of the firms gets the job.

What is an FTP client?

An FTP client is a program that moves files between your computer and a remote server. The name has stuck even though the protocol it refers to should no longer be used: modern clients primarily connect over SFTP or FTPS, which are encrypted, and support plain FTP mainly for compatibility with old servers.

This matters more than a naming quibble. Plain FTP transmits your username, your password and everything you transfer without encryption, so anybody positioned between you and the server can read all of it. It was designed before that was a realistic concern and it has not changed.

FTP, FTPS, SFTP and SCP, briefly

FTP is the original unencrypted protocol. FTPS is FTP wrapped in TLS, which encrypts it. SFTP is a different protocol entirely, running file transfer over an SSH connection, and is what most hosts and most people should use. SCP is an older SSH-based copy mechanism, still fine inside scripts.

The practical rule

Use SFTP. It is supported by every client on this page, by essentially every modern host, and it requires no extra cost or meaningful additional effort. If a host offers only plain FTP, that is worth treating as information about the host.

Which FTP client should you use?

FileZilla if you want free and cross-platform, WinSCP if you are on Windows and want the best scripting, Cyberduck if you want something simple, Transmit if you are on macOS and will pay for polish, and the command line if you are comfortable there.

The ‘worth knowing’ column carries the practical differences. FileZilla’s installer has historically offered additional bundled software on some platforms, which is worth reading rather than clicking through; and rsync is the correct answer to ‘this transfer takes too long’ far more often than a different client is.

Free is not the deciding factor here

Most of these are free and the free ones are genuinely good. The paid option earns its price on interface quality rather than capability, which is a legitimate reason to buy it and not a functional necessity.

The command line deserves more consideration than it gets

The built-in sftp command and rsync are available everywhere, need no installation, and are the only options that script cleanly. For anybody doing the same transfer repeatedly, learning two commands removes the client entirely.

How do you connect securely?

Ask your host for SFTP credentials, connect on port 22 rather than 21, use key-based authentication if offered, verify the host key fingerprint on first connection, and store credentials in the client’s encrypted store.

Verify the host key once, properly

The first time you connect, the client shows a fingerprint and asks whether you trust it. That is the moment the connection becomes trustworthy for every subsequent session, and clicking past it without checking removes the protection SSH was providing. Ask your host for the fingerprint and compare it.

Key authentication is easier as well as safer

A key pair removes the password from the process entirely: nothing to type, nothing to leak, nothing to rotate when someone leaves. Most hosts support it and the setup is a one-off task of a few minutes.

Never store credentials in a plain text file

Server credentials pasted into a text file or a shared document are among the most common sources of compromise for small websites. Every client on this page has an encrypted credential store, and a password manager is the right home for anything shared across a team.

Why should you probably not be transferring website files by hand at all?

Because manual transfer has no version history, no review step, no rollback and no record of who changed what. If you are doing it regularly for a website, the transfer client is not the problem — the absence of a deployment process is.

This is the most useful thing on this page and it is not what people arrive looking for. Choosing a better client makes a manual process slightly more pleasant; moving to deployment removes an entire category of website outage caused by a half-uploaded file or an overwritten change nobody can recover.

What deployment gives you that transfer does not

• A record of every change, who made it and when.
• The ability to roll back to any previous state in seconds.
• A review step before anything reaches a live site.
• Consistency: the same process every time, not whatever was dragged where.
• A staging environment where breaking something costs nothing.
• Automatic transfer of only what actually changed.
• No half-finished uploads leaving a site in a broken state.

None of that is available from any FTP client at any price, because it is a different problem. The transfer is the easy part; knowing what changed and being able to undo it is the part that matters when something goes wrong at an inconvenient time.

The migration timeline puts the free win first deliberately. Switching from FTP to SFTP takes one connection setting and can happen today; the rest is a genuine project worth doing and worth planning, and the first step should not wait for it.

When is manual file transfer the right answer?

For genuinely one-off tasks: retrieving a log file, uploading a single image, pulling a database backup, or inspecting something on a server you do not otherwise control. Those are legitimate and a client is the right tool.

The last row is where most website migrations go wrong. Dragging a site folder from one server to another silently omits hidden files, permissions and anything the transfer interrupted, and the omissions are discovered afterwards by users rather than by the person migrating.

What about the host’s built-in file manager?

Fine for one small edit, poor for anything repeated. It is convenient because it requires no setup, and it shares every weakness of manual transfer plus a browser session that can time out mid-save.

Do you need an FTP client for WordPress?

Occasionally, and less than most guides suggest. Plugins, themes and updates are handled inside the admin, and the times a file connection is genuinely needed are usually recovery situations — a plugin that has broken the site, or a file that needs removing when the admin is unreachable.

That recovery use is a good reason to have a working SFTP connection set up before you need it. Configuring one during an outage, without the credentials to hand, is considerably less pleasant than doing it on a quiet afternoon.

What file permissions should you set?

Follow your host’s documented recommendation rather than a number from a forum. Permissions that are too open are a genuine security problem and permissions copied from an unrelated setup are a common cause of a site that suddenly stops working.

Why is a transfer slow?

Usually many small files rather than total size, because each file carries connection overhead. Rsync solves this by transferring only differences, and archiving a directory before transferring it solves the small-file problem directly.

Is FTP being removed?

It has been progressively removed from places it used to be supported — browsers dropped built-in FTP support some years ago — and dedicated clients continue to support it for legacy servers. The direction of travel is clear and it argues for moving to SFTP now rather than when something forces it.

What should a team standardize on?

One protocol (SFTP), key-based authentication, a shared password manager rather than shared credentials in a document, and deployment for anything touching a live website. The client each person prefers matters far less than those four.

Common mistakes

Seven, and the first two are the ones that cause actual damage.

For the wider picture, our website maintenance page covers what a properly maintained site actually needs, and the web development page covers how the deployment side of this is set up in the first place.

A decision table: which client, for which person

Answer first: the client that fits you is decided by platform first, then by whether you script anything, then by whether you will pay for interface quality. The table below runs those three questions in order.

Notice that the last row is the only one where convenience wins, and it comes with the strongest caveat. A control panel file manager is genuinely the fastest way to make one small change and genuinely the worst way to make ten.

What a secure setup actually looks like, end to end

Answer first: SFTP on port 22, key-based authentication, host key verified once, credentials in an encrypted store, and a backup taken before anything is overwritten. Five things, all one-off except the last.

Six of the seven are configured once and then protect you indefinitely, which is an unusually good return for about fifteen minutes of setup. The seventh is the habit, and it is the one that saves you on the day something goes wrong.

Frequently asked questions