SFTP vs FTP for game servers

Plain FTP sends your password across the internet in readable text. SFTP does the same job over an encrypted connection, which is why hosts offer SFTP only.

6 min read · Updated Oct 21, 2026 · By GuavaHost Team

The two protocols

FTP (File Transfer Protocol) dates from the early 1970s. It moves files between your computer and a server, and it does it in plain text: your username, your password and the contents of every file travel unencrypted. Anyone sitting between you and the server, on a cafe network, a compromised router or a shared office connection, can read all of it.

SFTP (SSH File Transfer Protocol) is a completely different protocol that happens to do the same job. It runs inside SSH, the same encrypted channel used for secure remote shells. Your login and your files are encrypted end to end over a single connection.

There is also FTPS, which is old FTP with encryption bolted on. It is better than plain FTP but fiddly to configure, uses multiple ports and has largely lost out to SFTP. Despite the similar name it has nothing in common with SFTP.

The one-port detail matters more than it sounds. Classic FTP opens a separate connection for every transfer, which is why it trips over routers, firewalls and corporate networks so often. SFTP does everything over one connection on one port, so it just works.

Why hosts dropped FTP

Your file access password is effectively the key to your whole server: the world, the configs, the plugin secrets, everything. A protocol that broadcasts that password over any network you happen to be on is not a reasonable thing to offer in 2026. The security benefit of SFTP costs nothing and changes nothing about how you work, so there is no case for keeping FTP around.

If a host still offers plain FTP as the only option, treat it as a signal about the rest of their setup.

Connecting over SFTP

You need four things, and GuavaHost shows all of them in one place. On your server's Settings tab, expand Connection details and look under File access (SFTP):

• Address (host): the machine your server is on.
• Port: the SFTP port, which is not the same as your game port.
• Username: your SFTP username. It is not your account email, and using the email instead is the most common reason a login fails.
• Password: set with Set SFTP password in that same section. It is separate from your GuavaHost login, and if you sign in with Google, Discord or GitHub you will not have one until you set it.

Uploading files with SFTP has the full walkthrough including the client setup.

Clients worth using

• FileZilla (Windows, macOS, Linux): the default recommendation, free, two-panel layout, resumes interrupted transfers.
• WinSCP (Windows): free, a little more utilitarian, excellent at large batches and has a built-in editor.
• Cyberduck (Windows, macOS): free, friendlier interface, good drag and drop.
• Your code editor: Visual Studio Code with an SFTP extension, if you already live there.

In any of them, pick SFTP as the protocol, not FTP and not FTPS. If a client asks for "SFTP over SSH" or "SSH File Transfer Protocol", that is the same thing.

The first time you connect, the client will show a host key fingerprint and ask whether to trust it. That is normal: it is the server proving its identity. Accept it once and the client will warn you if it ever changes.

When the browser file manager is better

The panel's Files tab is not a lesser option, it is the right tool for most jobs. Use it when you are:

• Editing a config file. Open, change a line, save, restart. No client, no password, no transfer.
• Looking at a log or a crash report.
• Uploading one small file, such as a single plugin jar or a datapack.
• Unpacking a .zip you just uploaded, which the Unpack action does server side.
• Moving or renaming a folder.

Use SFTP when you are:

• Uploading a large world or a big modpack. The browser uploader has a per-file limit of 100 MB, and a dropped browser upload starts over.
• Uploading hundreds of small files at once, such as a mods folder or a resource pack set.
• Downloading a full copy of your server files to keep locally.
• Working through a flaky connection, because SFTP clients resume.

Editing configs in the file manager covers the browser side, and the two happily coexist: edit in the browser, bulk transfer over SFTP.

A third option exists and is often the fastest of all: Download from a link on the Files tab pulls a file straight from a URL into your server, at data centre speed, without it passing through your home connection at all. For a 3 GB modpack that is the difference between minutes and an evening.

Common SFTP problems

• Login failed, or authentication rejected. Almost always the wrong username. Copy it from File access (SFTP), do not type your email. If you have never set an SFTP password, set one.
• Connection refused or timed out. Check you used the SFTP port shown in the panel, not port 21 (FTP) and not your game port. Also check the client's protocol is set to SFTP.
• Connects, but the folder looks empty. Your server files sit in the directory you land in, so if the client opened somewhere else, navigate back.
• Transfers crawl. Upload speed from your home connection is usually the limit, not the server. Try Download from a link instead for anything you can get a URL for.
• Permission denied writing a file. Some files are managed by the game and recreated on start. Stop the server, make the change, start it again.
• A corporate or school network blocks it. SFTP uses one port, so it is far less likely to be blocked than FTP, but some networks filter it anyway. Firewalls and blocked ports covers how to tell.

Keep the credentials safe

Your SFTP password gives full read and write access to your server files. So:

• Make it unique. Not your GuavaHost login, not your game account, not anything reused.
• Do not save it in a client on a shared computer.
• Do not paste a config file containing other secrets into a public channel when asking for help. Blank them out first.
• Give a helper their own panel access with the permissions they need rather than your SFTP password. Adding sub-users covers it.
• If you think it leaked, set a new one in the same place and update any client that saved it.

Securing your panel account covers the account side, which matters just as much.

Common questions

Is SFTP the same thing as FTPS?

No, and the similar names cause real confusion. FTPS is the old FTP protocol with encryption added on top, using several ports. SFTP is a different protocol that runs inside SSH over a single port. If your client offers both, choose SFTP.

Why does my FTP client say it cannot connect?

Because it is probably still set to FTP. Open the site settings and change the protocol to SFTP, then use the host, port and username exactly as shown under file access in your server's connection details.

Do I need SFTP at all, or can I do everything in the browser?

You can run a server for months without ever opening an SFTP client. The browser file manager handles config edits, logs and small uploads fine. Reach for SFTP when a file is over the 100 MB browser limit or when you are moving hundreds of files at once.

Can I use the same SFTP details for every server on my account?

No. Each server has its own address, port and username, and each one needs its own entry in your client. Copy the details from that server's own connection details section rather than reusing another server's.

Still stuck? Jump into our Discord at discord.gg/GuavaHost and the team will help you out.

• sftp
• ftp
• files
• uploads
• security

Still need help? Our team is online 24/7 to answer questions.

Contact support