# The File Transfer Wiki This is a training site we will use to practice transferring content from local to a cpanel host - Site: https://test.srtafe.com.au/ ## FTP, FTPS and SFTP walk into a bar - Link: https://test.srtafe.com.au/ftp-ftps-and-sftp-walk-into-a-bar/ - Published: 2026-10-15T09:51:09+08:00 - Author: Wordpress Administrator FTP, FTPS and SFTP walk into a bar. And right away there’s a problem, because what is that? Three letters, three letters, four letters. Who named these? Nobody sat down and said “let’s make it easy.” Somebody just kept adding letters until it stopped working. So FTP goes up to the bartender and says, loudly, in front of everyone, “Hi, my username is admin and my password is hunter2.” The whole bar hears it. The guy in the corner writes it down. The bartender says, “Sir, you don’t have to announce it.” And FTP says, “What’s the problem? I’m just being open.” That’s FTP’s whole personality. He’s open. He’s the guy who tells you his PIN at the ATM and then asks why his account is empty. Now FTPS is standing next to him, in a trench coat. A trench coat! Indoors! And you look at him and you think, “I know that guy. That’s FTP.” But he says, “No, no. I’m secure. I’m encrypted.” And you say, “You’re the same guy with a coat on.” And he says, “Port 21, AUTH TLS, very different.” Sure. Very different. Same guy, same face, now he’s mumbling. And here’s the part I don’t understand about FTPS. He needs two connections. Two! One for talking and one for the stuff. Why can’t you do it all in one place? It’s like ordering a sandwich and having to go to a different counter for the bread. The bartender says, “Where do I send the drinks?” And FTPS says, “Oh, that depends. I’ll tell you a random number between 1024 and 65535.” The bartender says, “I’m the firewall. I don’t let random numbers in.” FTPS says, “Then we have a problem.” That’s it. That’s the whole relationship. A problem. Meanwhile SFTP is sitting at the end of the bar. Calm. Quiet. Drinking something sensible. One connection. Port 22. Nobody’s yelling. No trench coat. And the bartender walks straight over and says, “What’ll you have?” and SFTP says, “Whatever. I’ve got a key.” And the bartender says, “You’ve got a key?” SFTP says, “I’ve got a key, I’ve got a fingerprint, and I know who I’m talking to.” The bartender nearly cried. First honest customer all night. But here’s the thing about SFTP. You think he’s FTP’s cousin. “Oh, he’s the S one. Secure FTP.” No! No. He’s not related! He just borrowed the name. Same initials, different family. It’s like finding out your accountant and your dentist are both called Dave, and assuming they’re brothers. They’re not. They’ve never met. One does teeth. So FTP is still going. He’s up on the bar now. “I’d like to upload a photograph!” And he does. But he’s in ASCII mode, so the photograph arrives looking like it was assembled by a raccoon. And FTP says, “What’s wrong with it?” And everyone says,“ It’s a photo of your cat, and it’s a bunch of squares.” And he says, “I don’t see the issue.” That’s the thing about FTP. He never sees the issue. He’s got thirty connections open, the server says “421, too many connections,” and FTP says “Why is everyone being so negative?” Then the manager comes over. The WordPress guy. He says, “Who set the permissions on this place to 777?” And nobody says anything. Because it was FTP. It’s always FTP. 777! You know what 777 is? That’s a house where the front door, the back door and the garage are all open, and there’s a sign on the lawn saying “Please take whatever you like.” And FTP says, “I wanted it to be convenient.” Convenient! For who? And the manager says, “Did anyone back up the database before they started uploading things?” And again, silence. Because nobody did. Nobody ever does. We all think “ it’ll be fine,” and then it’s two in the morning, the site is a white screen, and you’re staring at it, and it’s just staring back. White. Blank. Judgmental. Like a fridge when you’ve opened it for the third time and there’s still nothing in there. So they all leave. SFTP pays his tab, nicely, with a key. FTPS is still trying to get his data channel through the firewall. FTP is on the footpath saying his password to a stranger. And the bartender turns to the manager and says, “You know, we could just not let FTP in.” And the manager says, “We can’t. He’s been coming here since 1971.” 1971! That’s older than the guy who wrote the manual! He’s still here! He’s the guy at the bar who’s been there since before the bar was built, and nobody knows how to ask him to leave. So that’s it. Use SFTP. Take a backup. And if you see a man in a trench coat at port 21, don’t ask him about his data channel. _Credit: Thank you to Claude for writing this filler content. It is an unsupervised learning task._ ## Close the Door on the Way Out - Link: https://test.srtafe.com.au/close-the-door-on-the-way-out/ - Published: 2026-10-15T09:00:00+08:00 - Author: Wordpress Administrator The migration is finished and the site loads. You are pleased, and it is tempting to close the laptop. Not yet. A few minutes of tidying will save you trouble later. Delete the test folders you created to check the connection. Remove any temporary files, such as phpinfo.php, old archives and database exports. These reveal details about your server, and a forgotten backup.zip is a gift to anyone who can guess the name. Check that permissions are correct, that wp-config.php is updated and that caches are cleared. Confirm that SSL works and the padlock appears. Click around the site as a visitor, and test the contact form. Finally, disconnect from the server properly instead of closing the window and hoping. Idle connections can linger on the server and count towards connection limits. If you saved a password in your FTP client, ask yourself whether you really should have. Then write down what you did. Future you, six months from now, will not remember. Future you will be grateful for a short, clear note, and slightly less grumpy. _Credit: Thank you to Claude for writing this filler content. It is an unsupervised learning task._ ## One Account Per Site, and Other Acts of Kindness - Link: https://test.srtafe.com.au/one-account-per-site-and-other-acts-of-kindness/ - Published: 2026-10-14T09:00:00+08:00 - Author: Wordpress Administrator It is tempting to use one FTP account for everything. It saves time, until a plugin gets compromised and the attacker discovers that one login opens every site you manage. Give each site its own FTP account, restricted to that site’s folder. If one gets compromised, the damage stays in one place. It also makes your logs readable, because you can see which account did what. Use strong, unique passwords stored in a password manager, and change the defaults that came with the hosting package. Default passwords are well known, and attackers try them first, politely. Limit access by IP address where you can, and disable anonymous FTP completely. Nobody needs strangers wandering around your upload folder. Finally, remember people leave. When a student, contractor or colleague finishes, remove their account and change any shared passwords. An old login that nobody remembers is the most reliable door into a website, and the one nobody is watching. Security is mostly a matter of boring housekeeping. It is not glamorous, but neither is explaining to a client how their site ended up selling imitation watches. _Credit: Thank you to Claude for writing this filler content. It is an unsupervised learning task._ ## Key-Based Login: Because Passwords Get Guessed - Link: https://test.srtafe.com.au/key-based-login-because-passwords-get-guessed/ - Published: 2026-10-13T09:00:00+08:00 - Author: Wordpress Administrator Passwords have one big weakness: someone can guess them. Brute force attacks do exactly that, trying thousands of passwords until one works. Your server logs may already show some visitors trying their luck. SSH key-based login offers a better way. You create a pair of keys. The private key stays on your computer and is never shared. The public key goes on the server. When you connect, your computer proves it holds the private key without ever sending it. There is no password to sniff and nothing for a bot to guess. Protect the private key with a passphrase, store it somewhere sensible, and never email it or put it in a shared folder. Treat it like the keys to the building, not a spare for the neighbour. Keys work with SFTP, so your FTP client can use them. FileZilla, WinSCP and Cyberduck all support them. On the first connect, check the host key fingerprint, since that confirms you are talking to the real server. Then enjoy logging in without typing anything, which feels slightly like magic and is much more secure. _Credit: Thank you to Claude for writing this filler content. It is an unsupervised learning task._ ## What Not to Upload: A Short, Judgmental List - Link: https://test.srtafe.com.au/what-not-to-upload-a-short-judgmental-list/ - Published: 2026-10-12T09:00:00+08:00 - Author: Wordpress Administrator Some files do not belong on a live web server, and your FTP client will happily upload them anyway. It has no opinions, which is both its charm and its flaw. Leave out the .git folder. It holds the entire history of your project, and if the web server exposes it, a visitor can download your source code and old mistakes. Leave out node_modules, which can contain tens of thousands of files that the live site does not need. Skip cache folders, local debug logs and any file called backup, old or final-final2. Be especially careful with database exports, .env files and notes that contain passwords. If they sit in a public folder, anyone who guesses the address can download them, and people do guess. Also skip the local development settings from tools such as Local, because they point to your laptop, not your host. A tidy upload is a quicker upload and a safer one. Before you transfer anything, look at the folder and ask a simple question: does the live site need this file to work? If the answer is “probably not”, you have your answer. _Credit: Thank you to Claude for writing this filler content. It is an unsupervised learning task._ ## Search and Replace Without Setting Your Database on Fire - Link: https://test.srtafe.com.au/search-and-replace-without-setting-your-database-on-fire/ - Published: 2026-10-11T09:00:00+08:00 - Author: Wordpress Administrator After moving a WordPress site, the old web address is scattered through the database like glitter after a party. You need to replace it everywhere, and the obvious way is a quick SQL REPLACE. Please resist. WordPress stores much of its settings and widget data as serialised data. That is text that includes the length of each value. If you change a web address with plain SQL, the text changes length but the stored length does not. WordPress then cannot read the data, and your theme options, widgets or menus quietly vanish. The safe tool is WP-CLI, the WordPress command line. The command `wp search-replace` understands serialised data and fixes the lengths as it goes. Run it first with the `--dry-run` option, which shows what would change without changing anything. Read the output, then run it again for real. Take a database backup before you start. Not after. Before. Also update siteurl and home in the wp_options table if the site cannot load properly. A careful search and replace takes a few minutes. A careless one takes an evening and several strong words. _Credit: Thank you to Claude for writing this filler content. It is an unsupervised learning task._ ## 421 Too Many Connections: The Server Says No - Link: https://test.srtafe.com.au/421-too-many-connections-the-server-says-no/ - Published: 2026-10-10T09:00:00+08:00 - Author: Wordpress Administrator There is a special sort of defeat in seeing “421 Too many connections from this IP” after thirty minutes of uploading. It means the server has limited how many connections one address may hold at once, and you have used them all. You probably did not do it deliberately. FTP clients open a new connection for each transfer, and failed transfers can leave half-open connections on the server until they expire. Retries stack up. Soon the server counts twenty connections and refuses the lot. A shared network makes it worse. If a whole classroom sits behind one public IP address, everyone shares the same limit, and your neighbour’s enthusiastic upload is now your problem. The cure is gentle. Set your client to one simultaneous connection and one simultaneous transfer. Upload one archive instead of thousands of files. Wait ten minutes or so for old sessions to expire, then try again. If it persists, ask your host to clear your sessions or check whether their firewall has blocked you. Resist the urge to click Reconnect fifty times. The server counts that as enthusiasm, not progress. _Credit: Thank you to Claude for writing this filler content. It is an unsupervised learning task._ ## Backups: Do It Before You Touch Anything - Link: https://test.srtafe.com.au/backups-do-it-before-you-touch-anything/ - Published: 2026-10-09T09:00:00+08:00 - Author: Wordpress Administrator There are two kinds of WordPress users: those who take backups and those who are about to. A backup is the thing you wish you had made at 4:55 on a Friday afternoon. Before any migration, take a full backup of two things: the site files and the database. The files include themes, plugins and uploads. The database holds your posts, pages, settings and users. Missing either one means you do not have a backup, just a collection of hope. Compress the files into one archive, export the database, and store both somewhere safe, away from the live server. Leave out things you do not need, such as cache folders, the .git folder and node_modules, which only make the backup larger. Then check that the backup works. A backup you have never tested is a rumour. Restore it to a practice site if you can, and make sure it loads. Do this before changing the server, before overwriting wp-config.php and above all before deleting anything. Deleting is easy. Un-deleting is where weekends go to disappear. _Credit: Thank you to Claude for writing this filler content. It is an unsupervised learning task._ ## Hashes: Did My File Survive the Trip? - Link: https://test.srtafe.com.au/hashes-did-my-file-survive-the-trip/ - Published: 2026-10-08T09:00:00+08:00 - Author: Wordpress Administrator A file hash is a short code worked out from a file’s contents. Change a single byte and the code changes completely. That makes hashes a handy way to check a file arrived exactly as it left. SHA-256 is the one to use. MD5 is quicker, but it is weak, so keep it for simple non-security checks. On Linux, run `sha256sum wp-config.php`. In PowerShell, run` Get-FileHash .\wp-config.php -Algorithm SHA256`. Do the same on the server copy and compare the two codes. If every character matches, the file is identical. Why bother? Because a transfer that says “successful” is not always perfect. Wrong transfer modes, dropped connections and flaky networks can all leave you with a file that looks fine and behaves badly. A hash will tell you in seconds, rather than after your client has found the problem. You do not need to hash every file. Check the important ones, such as wp-config. php, key plugin files and your archive before and after upload. It is a small habit that spares you a surprising number of mysteries. _Credit: Thank you to Claude for writing this filler content. It is an unsupervised learning task._ ## Zip It First: One Big File Beats a Thousand Small Ones - Link: https://test.srtafe.com.au/zip-it-first-one-big-file-beats-a-thousand-small-ones/ - Published: 2026-10-07T09:00:00+08:00 - Author: Wordpress Administrator A fresh WordPress install has well over a thousand files. Uploading them one at a time is like moving house by carrying each teaspoon separately. Your FTP client will open connections, ask permission, close connections and repeat, and the server may eventually tell you it has had enough. That “enough” is a real message: a limit on connections per IP address. Hit it and every new attempt gets a 421 error. The better method is to compress the site on your computer into a single .zip or. tar.gz file, upload that one file in binary mode, and extract it on the server. Your host’s file manager can usually do this, or you can use SSH if it is available. FTP itself cannot unzip anything, so do not wait for it to try. Once extracted, reset the permissions to 755 for folders and 644 for files, and verify a few key files with hashes. Then delete the archive, because leaving a full copy of your site sitting in a public folder is the sort of tidy-up you only forget once. _Credit: Thank you to Claude for writing this filler content. It is an unsupervised learning task._