Security Best Practices

Use SFTP or FTPS, Not Plain FTP

Plain FTP sends credentials and data in clear text. Prefer SFTP for Linux hosts and FTPS when the server only exposes FTP. WebDAV over HTTPS is another acceptable alternative.

Verify Host Keys

Never click Accept blindly when WinSCP shows an unknown host key the first time. Compare the fingerprint with the one issued by your provider. WinSCP records it and warns if it changes.

Use Key Authentication

Private keys with passphrases are stronger than passwords and never leave your machine. Store the .ppk in Pageant so the passphrase is typed once, not embedded in scripts.

Protect Stored Passwords

If you must save passwords, they are encrypted in the Windows registry, not plain text. Prefer saving a key file instead, and never hard-code credentials inside script files.

Limit Access

On the server side run accounts with the minimum privileges needed for the job, use SFTP-only accounts where possible, and disable unnecessary protocols.

Key Points

• Always use an encrypted protocol.
• Verify host key fingerprints on first connect.
• Keys beat passwords, and agents hide passphrases.
• Scripts should never contain embedded credentials.