Everyone assumes the S in SFTP means FTP with security added. It does not. SFTP is a different protocol that happens to share three letters.

SFTP stands for SSH File Transfer Protocol. It runs inside an SSH (Secure Shell) connection on port 22. There is one connection, one port and one encrypted tunnel. Your login, commands, file names and file data all travel inside it. A person capturing the traffic sees the software banner, some key exchange noise and then a lot of unreadable packets.

That single connection is why SFTP is the recommended choice for production WordPress sites. No data channel, no passive port ranges, no firewall negotiations. It either works or it does not, which is oddly refreshing.

SFTP also uses host keys. The first time you connect, your client shows a fingerprint, a short code that identifies the server. Check it. Clicking OK without looking is how people end up chatting to the wrong server, very securely.

Many hosts offer SFTP, but cheaper shared hosting sometimes does not. If yours does, use it. If it does not, ask whether you can have it, politely, and several times.

Credit: Thank you to Claude for writing this filler content. It is an unsupervised learning task.