[DEV]

Quick answer
Use SFTP over your server's SSH connection to transfer website files securely. On Windows with OpenSSH Client available, open PowerShell, connect with sftp, navigate to the website's document root and upload with put. Verify the exact file URL afterward.

SFTP is different from FTP
SFTP uses encrypted SSH transport. It does not use the FTP service or FTP data-port range. An aaPanel FTP account is not automatically an SSH/SFTP account. Use an authorized SSH account with the required folder access. See the OpenSSH SFTP manual for command options.

Before connecting

• Confirm the server hostname/IP and actual SSH port.
  
• Have an existing authorized SSH account and its authentication method.
  
• Verify the server's host-key fingerprint through a trusted source before accepting a first connection. Do not disable host-key checking to silence a warning.
  
• Confirm the website document root in aaPanel Website → site settings → Directory.
  
• Back up existing files before replacing them. Prefer a scoped account for routine transfers rather than administrator/root access.
  

1. Confirm Windows has the client
Open PowerShell and run:

Code:Copy

Get-Command sftp

If the command is unavailable, install/enable the official Windows OpenSSH Client feature using Microsoft's instructions for your Windows version. This guide assumes the client is already present; installation of the Windows feature was not needed in our lab.

2. Connect
Example using an existing SSH key:

Code:Copy

sftp -P 22 -i "C:/path/to/your/private-key" [email protected]

Replace the user, host, port and key path with your own values. The -P option for sftp is uppercase. Never copy another person's private key or post yours in a support thread. If the key has a passphrase, enter it privately when requested.

3. Check local and remote folders
At the sftp prompt, use pwd to check the remote location and lpwd for the local location. Move to the confirmed website folder and your local upload folder:

Code:Copy

cd /confirmed/website/document-root lcd "C:/path/to/local/files" ls

The example remote path is a placeholder. Accounts restricted to a chroot can show a different path from the full server path, so use the path available to that account.

4. Upload a new test file
Use a harmless file with a new filename first:

Code:Copy

put adminsforum-sftp-demo.html ls adminsforum-sftp-demo.html bye

Check whether a same-named file exists before uploading; put may overwrite it. For a full website, also transfer its referenced assets into the correct folders, and verify ownership/permissions expected by the application.

5. Verify the result
Open the file's HTTPS URL, for example https://your-domain.example/adminsforum-sftp-demo.html. Confirm its contents rather than relying only on a transfer message.


Original AdminsForum demo uploaded from Windows with SFTP and opened over HTTPS.

Our lab uploaded both a harmless text file and the branded HTML demo, confirmed the remote filenames and checked the HTML page through the browser. Existing homepage files were not replaced.

Common problems

• Connection refused or timeout: check the SSH service, port and firewall/provider rules.
  
• Authentication failed: check the SSH username, selected key and account authorization. The panel login and an FTP login are not interchangeable with SSH credentials.
  
• Permission denied while uploading: confirm the account can write to the intended folder. Do not use 777 as a blanket fix.
  
• Host key changed: verify the new fingerprint with the server administrator/provider before changing the trusted entry.
  
• Upload succeeds but URL is 404: check the domain document root, spelling, capitalization and actual uploaded location.
  

What we tested
On 11 October 2026, Windows OpenSSH SFTP transferred original demo files to our disposable Ubuntu/aaPanel lab using an existing SSH key and a previously verified host-key entry. The lab used its existing administrator SSH account; this test does not claim a restricted production SFTP user was created. Routine production transfers should use appropriately scoped access. No FTP firewall ports or new public services were opened for this test.

Related guide: Upload website files using aaPanel File Manager