Managing FTP and SFTP Connections with FileZilla Site Manager

The Problem: Manual Connection Fatigue

Connecting to multiple remote servers daily using the Quickconnect bar is inefficient. Manually typing hostnames, usernames, and passwords for every session increases the risk of typos and slows down deployment workflows. While Quickconnect is useful for one-off tasks, it lacks the ability to save specific protocol requirements or authentication methods for recurring targets.

Thesis: Centralizing Server Profiles for Speed and Control

FileZilla's Site Manager allows you to create persistent profiles for FTP, FTPS, and SFTP servers. By moving from Quickconnect to Site Manager, you can automate the connection process while choosing exactly how your credentials are stored—balancing the need for speed with the necessity of security.

Configuring Site Manager Profiles

To move beyond manual entry, you must define a site profile. This process allows you to specify the exact protocol and authentication method required by the server.

1. Navigate to File → Site Manager.
2. Click New Site and provide a descriptive name (e.g., staging-web-server).
3. Select the Protocol: Choose between FTP, FTPS (Explicit or Implicit TLS), or SFTP (SSH File Transfer Protocol).
4. Set the Logon Type:
   • Ask for password: No password is saved; you are prompted upon every connection.
   • Normal: The username and password are saved in the configuration file.
   • Key file: Used specifically for SFTP to authenticate via a private SSH key.
5. Enter the Host and User credentials.
6. Click OK to save the profile.

Understanding Password Storage and Obfuscation

When using the Normal logon type, FileZilla stores credentials in a local XML configuration file. It is important to understand that these passwords are not encrypted with a strong master password by default; they are obfuscated using a reversible method (similar to base64 encoding).

If you are on a shared machine or require higher security, you can disable password saving entirely:

1. Go to Edit → Settings → Security.
2. Uncheck the Save passwords option.
3. Restart FileZilla.

With this setting disabled, FileZilla will ignore any saved passwords in your profiles and force a manual prompt, preventing credentials from being stored in plain-text-adjacent formats on the disk.

Worked Example: SFTP Setup with SSH Key Authentication

In a professional engineering environment, password-based SFTP is often disabled in favor of SSH keys. Here is how to configure a profile for a server at sftp.example.com using a private key located at ~/.ssh/id_rsa.

1. Open Site Manager and create a New Site named Production-SFTP.
2. Set Protocol to SFTP - SSH File Transfer Protocol.
3. Set Host to sftp.example.com.
4. Set Logon Type to Key file.
5. Enter the User (e.g., deploy-user).
6. Click Browse next to the Key file field and select your id_rsa file.
7. Click OK.

Verification: Select the Production-SFTP profile from the dropdown menu and click Connect. If your key is passphrase-protected, FileZilla will prompt you for the passphrase. A successful connection is confirmed when the server's directory listing appears in the remote site pane.

Trade-offs: Convenience vs. Security

The primary trade-off in Site Manager is the convenience of "one-click" access versus the risk of reversible obfuscation. Because the sitemanager.xml file contains the credentials, anyone with read access to your user profile directory can potentially recover your passwords.

Practical check: You can verify if your passwords are being stored by locating your sitemanager.xml file in the FileZilla configuration folder and opening it with a text editor. If the <Password> tag contains a string of characters, your password is being stored in an obfuscated format.

Actionable Closing: Hardening Your Profiles

To optimize your workflow without compromising security, follow these three steps:

1. Audit: Review all profiles in Site Manager. Change any high-sensitivity production servers from Normal to Ask for password.
2. Migrate: Transition SFTP connections from passwords to Key file authentication.
3. Secure Exports: If you use the Export feature to move profiles to a new machine, treat the resulting XML file as a secret. Use chmod 600 on Linux/macOS to restrict access to the file and delete it immediately after the import is complete.