Preguntes Freqüents - FAQ

There are three common ways to transfer files to and from your ipxcore cPanel account: FTP, SFTP, and SSH/SCP. They look similar but have different security characteristics, and one of them you should not use at all. This article explains the differences and walks through setup for each.

Quick comparison

Why never use plain FTP

FTP transmits your username, password, and every byte of every file in plaintext. Any router, hotspot, or ISP between you and the server can read your credentials. In 2026, this is unforgivable when SFTP exists and works identically from a user perspective.

cPanel still supports FTP because some legacy CMSes and specific industrial workflows require it. We recommend you treat the FTP option as if it didn't exist.

SFTP setup (recommended)

SFTP is the modern replacement for FTP. It looks identical in your file-transfer client (drag-and-drop, file browser, etc.) but the connection is encrypted via SSH.

Connection settings

• Host: your domain (e.g., yourdomain.com) or the server hostname (in your welcome email)
• Port: 22
• Protocol: SFTP (sometimes labeled "SSH File Transfer")
• Username: your cPanel username
• Password: your cPanel password

Recommended clients

• FileZilla (free, Windows/Mac/Linux) — the most popular SFTP client. Use the latest version — older versions had a credential-leakage bug.
• Cyberduck (free, Mac/Windows) — clean UI, integrates with cloud storage too.
• WinSCP (free, Windows only) — full-featured, supports synchronization and scripting.
• Transmit (paid, Mac) — the polished option if you do this often.

SSH setup (for command-line access)

SSH gives you a Linux shell on your hosting account — useful for running scripts, using git, debugging, or batch file operations. SSH is enabled by default on all ipxcore accounts but disabled at the firewall level by IP allowlist.

Step 1: Enable SSH access for your IP

1. From your client area, go to your CSF firewall manager.
2. Find the entry for SSH and add your current IP (find it at api.ipify.org).

Step 2: Connect from a terminal

$ ssh username@yourdomain.com
username@yourdomain.com's password: ********
$ pwd
/home/username
$ ls
public_html  mail  etc

Once connected, you have a standard bash shell. cd public_html to get into your web root.

Switch to SSH keys (more secure than passwords)

Passwords can be brute-forced. SSH keys cannot. Switch to key auth in 5 minutes:

Step 1: Generate a key pair on your computer

$ ssh-keygen -t ed25519 -C "your-email@example.com"
Enter file in which to save the key (/home/you/.ssh/id_ed25519):
Enter passphrase (empty for no passphrase): ********

Use a passphrase — it encrypts the key on disk so a stolen laptop can't hand over your server access.

Step 2: Add the public key to cPanel

1. Open cPanel, go to SSH Access (under "Security").
2. Click Manage SSH Keys → Import Key.
3. Paste the contents of ~/.ssh/id_ed25519.pub (the public key, NOT the private one) into the "Public Key" field.
4. Click Import.
5. On the resulting page, click Manage next to your key, then Authorize.

Step 3: Connect with the key

$ ssh -i ~/.ssh/id_ed25519 username@yourdomain.com

If you saved the key to the default path, the -i flag isn't needed.

SCP for one-off file transfers

SCP is the simplest way to copy a single file or directory over SSH:

# Upload a single file
$ scp localfile.zip username@yourdomain.com:public_html/

# Download a directory
$ scp -r username@yourdomain.com:public_html/uploads/ ./

Common pitfalls

• "Connection refused" on SSH: your IP isn't whitelisted in CSF. Check the firewall manager.
• "Permission denied (publickey)": your SSH key wasn't authorized in cPanel. Re-check the Authorize step.
• "Host key verification failed": the server's SSH host key changed (legitimate after a server rebuild) or you're connecting to the wrong server. Run ssh-keygen -R yourdomain.com to clear the cached key, then reconnect.
• Slow SFTP transfers: your client may be set to use FTPS or to verify TLS for every file. Disable TLS verification or switch to SFTP proper.

Once you have 2FA enabled and SSH key authentication set up, your account is significantly harder to compromise than 99% of hosting accounts on the internet.