FTP, SFTP, and SSH are ways to access files or servers. They sound similar, but they are not the same level of access.
FTP
FTP transfers files, but traditional FTP is not encrypted. Use it only if there is no better option.
SFTP
SFTP transfers files over SSH. It is encrypted and is the better choice for most file-management work.
SSH
SSH gives command-line access. It is powerful, but also easier to misuse. Use it when you need to run commands, manage deployments, or work on a VPS.
Credentials
Create separate users where possible and remove access when it is no longer needed. Avoid sharing your main hosting login for temporary work.
If you only need to upload a theme or edit a file, SFTP is usually enough.
Prefer SFTP Over FTP
Traditional FTP can send credentials and data without suitable encryption. SFTP runs through SSH and protects the connection. Use the host name, port, username and authentication method supplied by your provider; do not assume an FTP login automatically works for SSH or SFTP.
Use the Right Access for the Job
SFTP is suited to uploading, downloading and renaming files. SSH gives a command shell for tasks such as Composer, Git, logs and scripted deployment, so it also carries more risk. If a contractor only needs to replace an image, do not grant unrestricted shell access.
Connect Safely
Verify the server fingerprint on the first connection instead of accepting an unexpected change. Prefer an SSH key protected by a passphrase, keep the private key off shared drives and remove access when work ends. Avoid saving production passwords in an unknown desktop client.
Protect the Website While Editing
Download a backup before changing important files and confirm you are in the correct document root. Do not solve permission errors by making everything world-writable. Upload into a temporary name where practical, then rename it into place so visitors do not receive a half-written file.
Troubleshoot Methodically
A timeout usually points to the host, port, firewall or network; an authentication failure points to the username, key or password. A successful connection with failed uploads suggests permissions or quota. Record the exact error and time when asking support for help.
