How to Connect to Your WordPress Site Using FTP or SFTP (2026 Guide)

To connect to a WordPress site, use an FTP/SFTP client with the server host, protocol, port, transfer-account username, and password or SSH key supplied by your hosting provider. Choose SFTP—or FTPS—whenever it is available: plain FTP sends your credentials and file contents without encryption. After you sign in, the remote panel shows your server files; the correct WordPress installation directory contains wp-config.php.

Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.

What you need before opening an FTP client

FTP software does not use the username and password you enter at /wp-admin/. WordPress authentication controls the dashboard; FTP, SFTP, and FTPS authenticate to your hosting server. Ask your host for a file-transfer account or create one in the hosting control panel before attempting to connect.

#	Preview	Product	Price
1		WordPress Multisite Administration	$34.38	Buy on Amazon
2		Mon Site WordPress – Volume 2 – Administration & Utilisation (French Edition)	$9.90	Buy on Amazon
3		WordPress 24-Hour Trainer	$3.95	Buy on Amazon
4		Teacher Record Book	$4.89	Buy on Amazon

As an Amazon Associate I earn from qualifying purchases.

• Server (host) name: Use the exact hostname provided by the host. Do not add a trailing slash unless the host explicitly tells you to.
• Protocol: The host may provide SFTP, FTPS, or plain FTP. These are different services; choose the one your account supports.
• Port: Port 22 is commonly used for SSH/SFTP, while port 21 is commonly used for FTP. A host can assign a different port, so its instructions take precedence.
• Username: This is the transfer account name, which may differ from your WordPress administrator name.
• Password or SSH key: Passwords are case-sensitive. Some SFTP accounts require a private SSH key instead of, or in addition to, a password.
• Account scope: Confirm which site directory the account can access, especially when one hosting account contains several domains, staging copies, or development environments.

If you do not have a transfer account, create an FTP or SFTP user in the hosting panel, assign it to the intended site directory, and note the protocol and port shown there. Do not guess these values from another account.

FTP, SFTP, and FTPS: which protocol should you select?

SFTP and FTPS are not interchangeable. SFTP runs over SSH, whereas FTPS is ordinary FTP secured with TLS. An FTP password may not work for SFTP, and an SFTP port cannot be used with an FTP connection type. WordPress Developer Resources recommends SFTP or FTPS instead of plain FTP whenever possible. Its guidance on updating WordPress, updated October 14, 2026, explains that FTP sends data in clear text; its FileZilla guidance, updated September 23, 2026, likewise recommends an encrypted protocol.

#1 Best Overall

Sale

WordPress Multisite Administration

$34.38

Buy on Amazon

When a host lists both SFTP and FTPS, choose the one supported by your account and client. Do not change the protocol merely because a familiar port fails.

Connect with FileZilla

1. Install and open the client

Install FileZilla from its official distribution, then open it. You can use the quick-connect bar for a temporary session, but Site Manager is safer for a saved profile because it keeps the protocol, port, and logon method together.

2. Create a Site Manager profile

1. Open File → Site Manager.
2. Select New Site.
3. Enter the server hostname exactly as supplied. Do not prepend a protocol label such as http:// or append a slash.
4. Open the Protocol menu and select SFTP – SSH File Transfer Protocol when the host supports it.
5. Enter the port supplied by the host. Use 22 only when the host uses the common SFTP default; use 21 only for a host-provided FTP service. A custom port is valid.

3. Set the logon type and credentials

Choose the logon type required by the transfer account. For password authentication, enter the account username and its case-sensitive password. For key-based SFTP, select the key configuration requested by the host and make sure the private key is readable by your operating-system account. Do not paste your WordPress dashboard password unless the host explicitly made it the transfer password.

4. Save and connect

1. Save the profile, then click Connect.
2. If FileZilla displays a server host-key or fingerprint prompt, stop and verify the fingerprint with your host through its documented support channel.
3. Accept the key only when the fingerprint matches. A changed or unexpected fingerprint can indicate a server migration, a configuration error, or a security problem; ask the host before proceeding.

5. Read the two-pane layout

The left pane is your computer; the right pane is the remote server. The message log above the panes records authentication and transfer errors. On the remote side, open the directory assigned to the site and locate wp-config.php. That file identifies the WordPress installation root. The root commonly also contains directories such as wp-admin, wp-content, and wp-includes, but the presence and location of wp-config.php is the decisive check.

Rank #2

Mon Site WordPress – Volume 2 – Administration & Utilisation (French Edition)

$9.90

Buy on Amazon

If the first remote directory is empty or contains several site folders, do not upload files yet. Confirm the account’s home directory and the intended domain or staging path with the host.

Connect with Cyberduck

Create an encrypted bookmark

1. Open Cyberduck and choose to create a new bookmark.
2. Select SFTP when the host provides SFTP.
3. Enter the server, port, username, and password or configure the required SSH key.
4. Save the bookmark and open it to start the session.
5. When Cyberduck displays a server fingerprint, compare it with the host’s published or support-confirmed fingerprint before allowing it.

Cyberduck’s fields have the same meaning as FileZilla’s: a bookmark does not convert FTP credentials into SFTP credentials, and a saved password does not replace a required SSH key. If the host provides FTPS rather than SFTP, select the matching TLS-enabled FTP option and use the port specified for that service.

Find the correct WordPress installation root

Connecting successfully does not prove that you are in the right site. Shared hosting accounts often contain multiple domains, addon sites, backups, and staging copies.

• Look for wp-config.php in the directory that serves the domain you intend to change.
• Check that the same directory contains the expected WordPress folders, especially wp-content.
• Compare the folder name with the document-root path shown in the hosting panel.
• For a staging site, verify the staging hostname before changing plugins, themes, or uploads.
• Never assume that the first directory shown after login is the public web root; it may be the transfer account’s home directory.

If WordPress was installed in a subdirectory, its root may be something like public_html/example rather than public_html. Follow the host’s document-root mapping instead of moving files to make the layout look familiar.

Rank #3

Sale

WordPress 24-Hour Trainer

$3.95

Buy on Amazon

Back up before uploading, replacing, or deleting anything

Make a current backup of both the WordPress files and the database before changing server files. An FTP download alone is not a complete WordPress backup: posts, settings, users, and plugin data live in the database. Conversely, a database export cannot restore themes, plugins, media, or core files.

File backup checklist

• Download the complete WordPress installation, including wp-content and wp-config.php, to a separate local location.
• Export the matching database using the host’s database tool or another supported method.
• Record the backup date, domain, and whether it came from production or staging.
• Keep at least one copy outside the hosting account so a server-level failure cannot remove the backup and site together.

Change only what you can identify

Upload to a temporary name when possible, compare the replacement with the existing file, and preserve the original until the site works. Avoid deleting unknown directories to “clean up” a listing. Keep permissions as restrictive as practical; broad write access can let an attacker or a compromised process alter more files than necessary. If an account lacks permission to change a required directory, ask the host to correct the account scope rather than making permissions globally writable.

Troubleshoot common connection and transfer errors

There is no connection attempt

Check the hostname, protocol, and port character by character. One incorrect character, an accidental space, or a protocol mismatch can prevent the client from reaching the service. Confirm that the account is active and that your network is not blocking the selected port. Use the host’s exact server name instead of the website’s public URL unless the host says they are the same.

“Authentication failed,” “incorrect login,” or “user does not exist”

Compare the username, password, protocol, and port with the transfer account details. Passwords are case-sensitive. A valid FTP username may be rejected by SFTP, and an account configured for SSH-key authentication will reject a password-only attempt. Ask the host whether the account requires an SSH key, a custom SFTP port, or a separate transfer password.

Rank #4

Teacher Record Book

• Keep track of everything from attendance to test scores
• Spiral bound
• Measures 8-1/2" x 11"

$4.89

Buy on Amazon

“Could not retrieve directory listing”

For an FTP connection, select passive transfer mode in the client’s transfer settings and retry. Passive mode lets the server provide a data endpoint that is more compatible with routers and firewalls. If passive mode does not resolve the error, verify the host’s FTP data-channel requirements and whether a firewall or security product is filtering the negotiated ports. Do not switch to random ports or disable security software permanently.

SFTP connects but shows an authentication or host-key error

Confirm that you selected SFTP rather than FTP, that the port is the host’s SSH/SFTP port, and that the account has the required password or private key. For a host-key warning, do not accept blindly; obtain the current fingerprint from the host and compare it with the client prompt.

You connect but receive “permission denied”

The account may be restricted to a different directory or may not have write permission for the target path. Check that you are in the correct site’s root, then ask the host to adjust the account’s directory scope or ownership. Broadly loosening permissions can expose the site to unauthorized changes and is not a safe first fix.

Files upload but the site still behaves the same

Verify that the file was uploaded to the active site’s document root rather than a staging or backup folder. Check the transfer queue for failed items and confirm the remote timestamp and size. A caching layer, PHP opcode cache, or WordPress cache can also delay visible changes; clear the relevant cache only after confirming that the correct file was changed.

FileZilla and Cyberduck compared

Neither client can compensate for an account that lacks SFTP, uses a custom port you have not entered, or is restricted to another directory. The host’s account configuration determines compatibility.

Operational and security practices worth keeping

• Prefer encrypted transport: Use SFTP or FTPS whenever the host supports it. Plain FTP exposes credentials and file contents to anyone able to observe the connection.
• Use a dedicated transfer account: Give it access only to the intended site directory and remove it when the maintenance task is complete if your workflow permits.
• Protect saved credentials: Secure the computer and the client’s saved-profile storage. Do not place passwords in screenshots, tickets, or shared documents.
• Verify server identity: Check the host fingerprint on first connection and after a warning about a changed key.
• Work on staging first: Test plugin, theme, and code changes in a staging copy before production when your hosting setup provides one.
• Preserve permissions: Ask the host for the least-privileged ownership and write access needed for the task.
• Close unused sessions: Disconnect when finished and avoid leaving an administrative transfer client connected on a shared or unattended computer.

A quick decision path

1. If the host offers SFTP, choose SFTP and use its SSH port, commonly 22 but not necessarily.
2. If SFTP is unavailable but encrypted FTP is offered, choose FTPS and enter the host’s TLS port and security mode.
3. Use plain FTP only when it is the host’s sole option, understanding that it does not protect credentials or data in transit.
4. Before any file change, confirm the domain, installation root, backup status, and account permissions.
5. After connecting, verify wp-config.php and the expected WordPress directories before uploading or deleting anything.

WordPress Developer Resources identifies 21 as the commonly documented FTP port and 22 as the commonly documented SSH/SFTP port, but those numbers are conventions rather than guarantees. A custom port supplied by the host always wins.

Quick Recap

SaleBestseller No. 1

WordPress Multisite Administration

$34.38

Bestseller No. 2

Mon Site WordPress – Volume 2 – Administration & Utilisation (French Edition)

$9.90

SaleBestseller No. 3

WordPress 24-Hour Trainer

$3.95

Bestseller No. 4

Teacher Record Book

Keep track of everything from attendance to test scores; Spiral bound; Measures 8-1/2" x 11"

$4.89

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.