Upload files with FileZilla

Connect FileZilla over SFTP or FTPS, and never over plain FTP — which sends your password in the clear.

Transfer files with FileZilla. Applies to shared, reseller and Premium hosting.

Never use plain FTP. It sends your username and password unencrypted, so anyone on the network between you and the server can read them. Use SFTP or FTPS — both are below, and neither is harder to set up.

SFTP — preferred

SFTP runs over SSH. It is the better option: one encrypted connection, no separate data channel, and it supports key authentication.

It requires SSH to be enabled on your account — see Connect over SSH.

Open File → Site Manager, then New Site.
On the General tab:

Field Value
Protocol SFTP – SSH File Transfer Protocol
Host Your domain or server hostname
Port 22
Logon Type Normal, or Key file
User Your cPanel username
Password Your cPanel password
Select Connect.

Field	Value
Protocol	SFTP – SSH File Transfer Protocol
Host	Your domain or server hostname
Port	`22`
Logon Type	Normal, or Key file
User	Your cPanel username
Password	Your cPanel password

For key authentication, choose Key file and select your private key. See Add an SSH key.

FTPS — where SSH is unavailable

FTPS is ordinary FTP wrapped in TLS.

File → Site Manager → New Site.
On the General tab:

Field Value
Protocol FTP – File Transfer Protocol
Host Your domain or server hostname
Port 21
Encryption Require explicit FTP over TLS
Logon Type Normal
User An FTP account username
Password Its password
Select Connect and accept the certificate.

Field	Value
Protocol	FTP – File Transfer Protocol
Host	Your domain or server hostname
Port	`21`
Encryption	Require explicit FTP over TLS
Logon Type	Normal
User	An FTP account username
Password	Its password

Encryption must be set to require explicit TLS. Leaving it on "if available" lets FileZilla fall back to plain FTP silently — which is the situation you are trying to avoid.

Create FTP accounts under cPanel → FTP Accounts. Note the username is usually user@example.com, not just the part before the @.

Where to put files

Upload into public_html — see Where to upload your website files.

To see .htaccess and other dotfiles, enable Server → Force showing hidden files.

If the connection fails

Connection refused on port 22 — SSH is not enabled on the account. Use FTPS, or ask support to enable it.
Times out — your IP may be firewall-blocked after failed logins. See Unblock an IP address.
Authentication fails on FTPS — the username is usually the full user@example.com form.
Connects then hangs listing files — a passive mode issue. Under Settings → FTP, switch between passive and active.