Performance Glossary
SFTP: One Port, One Service, One Set of Keys
You want the drag-and-drop workflow you already know, without a second daemon on the box and without a password crossing an untrusted network.
The short answer
SFTP is a file transfer subsystem of SSH, not FTP with encryption added — a single protocol on a single port, authenticated with the same credentials or keys you already use for shell access.
The operational win is that one hardened service covers shell, transfer and tunnelling. There is no second daemon to patch, no second port to expose, and no separate credential set to rotate.
By the HostingFast team · Reviewed 15 August 2026
0
Terms, measured not asserted
100+
Entries wired together
Real
Client settings included
Free
Free to read, always
Despite the name it shares no design with FTP. There is no separate data channel, no passive mode negotiation and no firewall port range to reason about — which is why it passes cleanly through networks that make classic FTP awkward.
Key-based authentication is where it pulls decisively ahead. The private half never leaves your machine, so logging in becomes proof that you hold a file rather than recall of a phrase, and password-guessing bots have nothing left to guess at.
Connecting, with the settings written out
In FileZilla, Cyberduck or the client of your choice: protocol SFTP, host your domain or server hostname, port 22, and your hosting username. Point the client at your private key file if you have one configured, or supply the account password if you have not yet moved to keys.
The first connection shows a host key fingerprint. Accept it once and the client will warn you if it ever changes, which is exactly the alert you want if traffic is ever being intercepted. Clicking through that warning without reading it discards most of the protection.
Why one port matters operationally
Classic FTP needs a control channel and a range of data ports, which is why it breaks behind NAT and why passive mode exists at all. SFTP multiplexes everything inside the SSH connection, so a single open port serves shell, file transfer and port forwarding together.
That consolidation is also a security posture. One service to keep patched, one authentication path to audit, one set of logs to read. Every extra daemon on a machine is another thing that needs watching, and FTP daemons have historically needed plenty.
Where the throughput goes
Encryption costs some CPU, and on modern hardware with AES instructions that cost is small enough to disappear behind the network on any normal connection. If a transfer feels slow, the cause is almost always file count rather than cipher overhead.
The same archive-first advice applies as anywhere else: one tar file moves far faster than ten thousand thumbnails. With SSH on the developer plans you can compress at one end and extract at the other, which removes the per-file cost entirely.
Moving off passwords for good
Generate a key pair, add the public half to your account, then test the connection before you disable anything. Once a key login works, password authentication becomes a fallback you can stop relying on, and automated deploys become possible without storing a password in a script.
Every account on our shared plans runs isolated, so an SFTP session reaches your files, your databases and your processes and nothing else on the machine. That isolation is what makes handing a key to a contractor a scoped decision rather than an open one.
Access protocols, compared honestly
Where two protocols do a similar job, these entries say what each costs to operate and which one we would actually use on the day.
SFTP is on every plan, and the developer-focused tiers add SSH, Git and Composer for the workflows that assume a shell.
- Exact client settings, no guessing
- Host key warnings explained
- Throughput attributed correctly
- Key setup tested before switchover
Why HostingFast
Standard on every plan
Settings you can copy
Protocol, host, port and authentication written out, so the first connection works rather than half-works.
The fingerprint prompt explained
What the host key warning is for, and why clicking through it throws away most of the guarantee.
One service, one audit
The operational case for a single hardened daemon instead of a shell service and a transfer service.
Cipher cost put in proportion
Why encryption is not what makes your transfer slow, and what actually is.
A safe path to key auth
Test the key before disabling the password, in the order that avoids locking yourself out.
Isolation stated plainly
What a session on our shared plans can and cannot reach, so handing over access is a scoped decision.
Quick Start
From order to online
- 1
Set protocol, host and port 22
Three fields in any client. Most first-connection failures are a client still set to FTP on port 21 rather than anything on the server.
- 2
Record the host key fingerprint
Accept it once, then treat any later change as a genuine alert rather than a dialog to dismiss on the way to work.
- 3
Add a key, then test before switching
Confirm a key-based login succeeds in a second session while the first is still open. Only then stop depending on the password.
Built In
Loaded onto every plan
- SSH, Git and Composer on the developer-focused plans
- Free SSL on every plan, reissued automatically well before it can expire
- Daily backups with a self-service restore you run yourself from the panel
- NVMe on every tier — the entry plan runs the same drives as the top one
- LiteSpeed compiled into the server, not a caching plugin bolted on afterwards
- Staging you can clone, break and throw away before anything reaches live
- DDoS filtering absorbed at the network edge, before it reaches your workers
- Virus and spam screening running on every mailbox by default
- A human on support at any hour, including for the awkward questions
- Money-back cover: 30 days on hosting plans, 7 on reseller
Frequently Asked
What people ask us most often
Why is SFTP on port 22 rather than a port of its own?
Because it is a subsystem of SSH rather than a separate protocol. One connection carries shell, file transfer and tunnelling, so there is one port to expose, one credential path to audit and no second daemon queueing up for security patches.
Is SFTP different from FTPS, or just a different name for it?
Genuinely different. FTPS is the old FTP protocol wrapped in TLS, complete with its separate data channel and passive mode negotiation. SFTP shares no code or design with FTP at all — it runs inside SSH, needs one port, and behaves predictably behind NAT.
Do I get shell access on shared hosting?
On the developer-focused plans, yes — SSH, Git and Composer included. Every account runs isolated, so a shell session reaches your files, your databases and your processes and nothing beyond them. That is what makes WP-CLI and push-to-deploy workflows practical without renting a VPS.
Is staging an add-on, or part of the plan?
Part of it, on the plans that carry it. Clone the live site, do the work on the clone, then push it live once it behaves. That is the whole difference between hoping an update survives contact with production and knowing it does before a visitor ever meets it.
Keep reading
Document Root
The folder a domain resolves into, and the misconfiguration that leaks your source.
FTP
The bulk transfer protocol, and why the unencrypted flavour has no place left.
Best LiteSpeed Hosting
LiteSpeed hosts compared on cache behaviour rather than on the badge in the footer.
CMS Hosting
Tuned hosting for WordPress, Joomla, Drupal and the rest, with caching configured properly.
Web Hosting
cPanel hosting on NVMe with LiteSpeed, free SSL and a migration included.
Changing hosts? Run through our checklist first.
A straightforward sequence for a switch your visitors never feel: which files move first, how to shift email across without losing a single message, the right moment to repoint DNS, and the two mistakes behind almost all the downtime we get asked to rescue.
One key, one port, every file.
SFTP included on every plan, SSH and Git on the developer tiers, and isolated accounts so a session reaches only your own files.
View CMS Hosting plans