Manage files with FTP and SFTP

File transfer remains the most direct way to update a PHP site. The key is to use an encrypted protocol, connect to the right folder, and never expose files that must stay private.

1. Choose the protocol

Plain FTP sends credentials and files in clear text: an untrusted network can read them. Prefer SFTP. If a client or network forces FTP, use FTPS with explicit TLS, never bare FTP over the Internet.

2. Credentials and accounts

Create an FTP account in KeyHelp with a long, unique password. One account per person makes revocation easy when access ends. Do not share the main account between several people: you would lose traceability.

Credentials often look like user or [email protected]; the panel shows the exact host and port. Use a password manager rather than a text file.

3. Connect

With a graphical client (FileZilla, WinSCP, Cyberduck), enter host, port, protocol, user and password. From the command line:

sftp [email protected]

For explicit FTP over TLS, lftp is convenient:

lftp -u user ftps://your-domain.tld

Verify the SSH host key fingerprint on the first SFTP connection. An unexpected fingerprint may indicate an intermediary or a server change.

4. Tree and permissions

Stay inside your domain folder. Parent folders may hold other sites or system files outside your scope. After uploading:

• files 644, directories 755;
• no recursive 777 permissions to "make it work";
• ownership managed by the panel, not by an arbitrary chown.

A CMS asking for 777 usually hides an ownership or cache-path problem. Fix the cause instead of widening permissions.

5. Sensitive files and verification

Never leave in the web root: .env, a readable wp-config.php, .sql dumps, .zip or .tar.gz archives, or a .git folder. Move them above the root or delete them after use.

Then check:

• https://your-domain.tld/.env returns 403 or 404;
• an uploaded test file is served correctly;
• client-reported permissions match 644/755;
• no plaintext FTP connection is in use.

After the task, close the session and remove temporary accounts.