FTP is still a common way to upload site files, but plain FTP sends your login, password and files in clear text that anyone on public Wi-Fi or along the route could capture. SFTP runs over SSH and encrypts the whole session. The interface looks the same — two panes, drag and drop — but the security is in a different league. Here's how to set it up in FileZilla and WinSCP, the two most popular Windows clients.
SFTP vs FTP vs FTPS
FTP is the old unencrypted protocol on port 21. FTPS is FTP with TLS added. SFTP is a different protocol running inside SSH, usually on port 22, so your hosting account needs SSH access. sayt.uz customers can check their plan in the sayt.uz cabinet or with support; without SSH, at least use FTPS.
What you need
- Host — server name or IP from your hosting details, e.g.
server.example.uz. - Port — normally 22.
- User — your hosting login.
- Password or SSH key — a key is safer.
In ISPmanager, site files usually live in /var/www/login/data/www/example.uz; after connecting, open www and then the domain folder.
FileZilla
Download it from the official site and decline any bundled offers. Open File → Site Manager, add a site, choose "SFTP - SSH File Transfer Protocol" and fill in Host and Port. For Logon Type pick "Normal" or "Ask for password", or "Key file" to use a key. FileZilla accepts .ppk keys and offers to convert OpenSSH keys. On first connect an "Unknown host key" dialog appears: compare the fingerprint with the one support gives you before ticking "Always trust this host". FileZilla stores saved passwords in its settings, so set a master password in Settings or switch to a key.
WinSCP
In the Login window choose New Site, keep File protocol as SFTP and fill in Host name, Port number and User name. For a key, go to Advanced → SSH → Authentication and set "Private key file"; WinSCP also converts OpenSSH keys to .ppk. You can edit server files directly — save and they upload — and "Keep remote directory up to date" syncs a local folder automatically. Saved sessions can be protected with a master password, which is worth enabling on any shared or office computer.
Preparing a key
ssh-keygen -t ed25519 -C "office-pc"
type $env:USERPROFILE\.ssh\id_ed25519.pubAdd that single public-key line to ~/.ssh/authorized_keys on the server; the private file stays on your PC.
Common errors
| Message | Likely cause |
|---|---|
Connection refused / timed out | Wrong port, SSH not enabled, or port blocked on your network |
Authentication failed | Wrong credentials, or key missing or with bad permissions |
| Protocol still set to FTP | Client tries port 21 — select SFTP explicitly |
| Files uploaded but not visible | Wrong folder; check the domain directory |
Repeated wrong passwords can get your IP temporarily blocked, so verify the login and port before retrying instead of hammering the connect button.
Example: a wedding hall gallery
A design studio adds hundreds of photos a month to a Bukhara wedding hall's gallery. They used plain FTP, sometimes over café Wi-Fi. After a security review flagged this, SSH was enabled and each staff member got a key. Now they connect with one click from a saved WinSCP session, sync the new-photos folder automatically, and when someone leaves only their key is removed.
Good habits
Don't upload .git, local .env files or large backup archives into the web folder. Keep simultaneous transfers modest (FileZilla's Transfers setting). Typical permissions are 755 for folders and 644 for files, adjustable from either client's context menu.