How FTP and SFTP work
Both are ways of moving files between your computer and the web server: uploading a theme, downloading a copy of the site, replacing an image, or pulling a log file down to read. You connect with a client such as FileZilla using a host address, a username and a password, and the server’s directory tree appears alongside your own.
The difference is protection. FTP is the older protocol and sends its instructions, and in most configurations its credentials, as readable text across the network. SFTP performs the same operations inside an encrypted SSH connection, so anyone able to observe the traffic sees nothing usable. There is also FTPS, which wraps traditional FTP in TLS — a different route to a similar outcome.
Why the difference matters
Hosting credentials are keys to the entire site. Someone who captures them can insert redirects, publish spam pages, install a backdoor, or take the site offline. Plain FTP over café or airport wifi hands those keys to anyone patient enough to look, which is why most reputable hosts now discourage or disable it altogether.
The consequences show up in search as well as in security. Injected pages and hidden redirects are a common reason a site gets flagged as hacked, and recovering search visibility afterwards takes far longer than the transfer ever saved.
Where file transfer goes wrong
Editing production files directly is the biggest one. Uploading a changed theme file straight onto the live site leaves no record of what changed, no way back and no test. When the page breaks, recovery depends on someone remembering exactly what they did.
Shared accounts come next. One login passed between a developer, a designer and an agency cannot be revoked for one person, and nobody can tell who uploaded what. Most panels let you create separate accounts limited to a single folder, and there is no good reason not to.
The quiet one is leaving files behind. Old archives, database exports and backup folders uploaded temporarily stay on the server, often publicly reachable, sometimes for years.
What to do about it
Use SFTP, and switch plain FTP off in the hosting account if the option exists. Where the host supports keys instead of passwords, use them — that is the same mechanism described under SSH access, and it removes the password from the equation entirely.
Give every person their own account, scoped to the folder they need, and delete it when the work ends. Make changes on a staging environment first, take a backup before touching production, and remove any archive or database export as soon as the transfer has finished.