What port SFTP uses
SFTP uses TCP port 22, the same port as SSH, because it runs as a subsystem inside the SSH connection. HTTPS uses port 443, plain HTTP uses 80, and FTP uses 21. In FileZilla, choose the SFTP protocol and leave the port at 22 unless the server was moved to a custom port.
There is no second data channel. One TCP connection carries the login, the directory listing and the file bytes, which is why SFTP works through a firewall that blocks passive FTP ports. The default comes from the SSH daemon, so if SSH moves to port 2222, SFTP moves with it.
- SFTP: TCP 22, inherited from SSH.
- SSH terminal: TCP 22, the same listener.
- FTP: TCP 21 for control and 20 or a passive range for data.
- FTPS: TCP 21 in explicit mode, 990 in implicit mode.
Port numbers for SFTP, HTTPS, HTTP, FTP and POP
Most port questions come from mixing up four protocols. This table is the short answer for each one, with the port a client should be told.
| Service | Port | Notes |
|---|---|---|
| SFTP | 22 (TCP) | Runs inside SSH; no separate data port |
| SSH | 22 (TCP) | Changing it moves SFTP too |
| HTTP | 80 (TCP) | Usually redirects to 443 |
| HTTPS | 443 (TCP) | HTTP/3 uses UDP 443 |
| FTP | 21 control, 20 data | Passive mode uses a configurable high range |
| FTPS | 21 explicit, 990 implicit | FTP wrapped in TLS, not the same as SFTP |
| POP3 | 110, or 995 with TLS | Mail download, replaced by IMAP on most accounts |
| IMAP | 143, or 993 with TLS | Mail sync, the usual choice today |
| SMTP | 25, 587 or 465 | 587 for submission with STARTTLS |
| MySQL | 3306 | Should never be open to the public internet |
The port number for HTTPS is 443
HTTPS runs on TCP port 443. Port 80 exists so an old link still resolves; the server answers with a redirect to the https address, and the browser opens a new connection on 443. HTTP/3, which newer browsers negotiate, runs over UDP 443 on the same hostname.
If a URL with https:// times out while http:// loads, port 443 is blocked or no certificate is bound to the site. That is a firewall or virtual host problem, not an SFTP one, even though both can appear on the same server.
FileZilla port settings for FTP and SFTP
FileZilla asks for a host, a username, a password and a port. The protocol dropdown decides what the port means, and getting that pair wrong is the most common FileZilla error.
- Open File, then Site Manager, then New site.
- Set Protocol to SFTP - SSH File Transfer Protocol for port 22. Set it to FTP for port 21.
- Enter the host as your domain or server IP, with no sftp:// prefix when the protocol dropdown already says SFTP.
- Leave the Port field empty to use the default, or type the custom port your host gave you.
- Set Logon Type to Normal and enter the username and password, or switch to Key file for key authentication.
- Click Connect. A directory listing of your home folder means the port and protocol agree.
If FileZilla reports "Connection refused" on port 21, the server is not running plain FTP, which is normal on modern hosting. Switch the protocol to SFTP and try port 22 before you change anything else.
Change the SFTP port on Linux
You change the SSH port, and SFTP follows. Keep the old port open until the new one is proven, or you can lock yourself out.
- Edit the daemon config: sudo nano /etc/ssh/sshd_config and add a line Port 2222 below the existing Port 22.
- On Ubuntu 22.04 and later, SSH may be socket-activated. Check with systemctl status ssh.socket; if it is active, add ListenStream=2222 to a drop-in under /etc/systemd/system/ssh.socket.d/ instead.
- Open the firewall: sudo ufw allow 2222/tcp, or sudo firewall-cmd --add-port=2222/tcp --permanent and reload.
- On SELinux systems, label the port: sudo semanage port -a -t ssh_port_t -p tcp 2222.
- Restart the service: sudo systemctl restart ssh, or systemctl daemon-reload then restart ssh.socket on socket-activated hosts.
- Test from a second terminal with ssh -p 2222 user@server before you close the first session.
- Remove the old Port 22 line once the new port works, restart again, and confirm 22 no longer answers.
You know it worked when ss -tlnp shows sshd listening on the new port only, an SFTP client connects on it, and a connection to the old port is refused. Keep the first SSH session open until all three are true.
SFTP connection refused or timed out
The error text names the layer that failed. Read it before you change a port number.
| Message | Cause | Fix |
|---|---|---|
| Connection refused | Nothing is listening, or SSH is stopped | Check systemctl status ssh, confirm the port with ss -tlnp |
| Connection timed out | A firewall is dropping packets | Open the port in ufw or firewalld, and in the provider panel |
| Connection closed by remote host | Too many failed logins, often fail2ban | Unban the IP, then use a key instead of a password |
| Permission denied (publickey) | The key was not offered or not authorised | Add -i with the right key, or place it in authorized_keys |
| Server refused our key | Wrong user, or home directory permissions | Use the right account and set 700 on ~/.ssh and 600 on the key |
Test the port without a client: nc -zv server 22 from Linux or macOS. "Succeeded" means the port is open and the problem is authentication. A timeout means the network path, and no amount of retrying the password will help.
When you cannot use port 22
Some office networks and ISPs block outbound port 22. The fix is either to run SSH on 443 or 2222 at the server, or to tunnel through a host that is reachable.
Running SSH on 443 conflicts with a web server on the same IP, so use a different IP or a separate port such as 2222. On a Linux hosting account or a managed panel, the provider sets the port and publishes it in the welcome mail; do not change sshd on a server you do not own.
For moving files once the port is sorted, the scp command uses the same port 22 and the same key. Both are covered by the SSH access that comes with a WebJi VPS.
Frequently Asked Questions
What port does SFTP use?
SFTP uses TCP port 22 by default because it runs as a subsystem over SSH. It needs no second data port. If the server's SSH is moved to another port, SFTP moves with it, and the client must be told the new number.
Is SFTP port 22 or 21?
SFTP is port 22. Port 21 belongs to FTP, a different protocol with no encryption. FTPS also starts on 21 and adds TLS. If a client is set to FTP on port 21 and the server only runs SSH, the connection is refused.
What is the port number for HTTPS?
HTTPS uses TCP port 443. Port 80 serves plain HTTP and normally redirects to 443. HTTP/3 uses UDP 443. A site that loads on http but not https has a firewall or certificate problem on 443, not an SFTP fault.
What port do I enter in FileZilla?
Choose the SFTP protocol and leave the port empty or set 22. For plain FTP, choose the FTP protocol and use 21. The protocol dropdown and the port must match, or FileZilla connects to the wrong service and reports a refusal.
How do I change the SFTP port?
Change the SSH port, since SFTP shares it. Add Port 2222 to sshd_config, open 2222 in the firewall, label it for SELinux if used, restart ssh, and test from a second session before removing port 22. On socket-activated Ubuntu hosts, edit the ssh.socket drop-in.
Why is my SFTP connection refused?
Either the SSH service is stopped, the port is wrong, or a firewall is blocking it. Run ss -tlnp to see what the server listens on, and nc -zv server 22 to test the path. A refusal means nothing is listening; a timeout means packets are being dropped.