How to use SCP for secure file transfers

SCP (Secure Copy) transfers files between networked Linux systems using SSH encryption. This protects your data and credentials from interception during transfer, making it the standard tool for secure remote file management on VPS environments.

You will learn SCP command syntax, configure transfer options and execute secure copies between local and remote systems. By the end, you will transfer individual files, entire directories and manage remote-to-remote copies without exposing your data.

Understanding SCP syntax

SCP follows a consistent command structure that defines what you copy and where it goes. Learning this syntax allows you to construct any transfer command correctly.

The basic SCP command structure looks like this:

scp [options] source destination

Each component serves a specific purpose:

• scp invokes the secure copy command
• options modify command behaviour (covered in the next section)
• source specifies the file or directory to copy, formatted as username@hostname:/path/to/file for remote locations or /path/to/file for local files
• destination defines where the file goes, using the same format as source

For remote locations, replace username with your SSH username, hostname with the server’s IP address or domain name and /path/to/file with the actual file path. Local paths omit the username and hostname components entirely.

Common SCP command options

SCP options control transfer behaviour, from port selection to compression. Adding these flags between scp and your source path modifies how the transfer executes.

These options handle the most common transfer scenarios:

• -P targets a specific SSH port when the default port 22 is unavailable. Use -P 2222 to connect via port 2222.
• -p preserves file metadata including ownership, permissions and timestamps. This creates an exact copy with all original attributes intact.
• -q suppresses progress output and completion messages. This keeps your terminal clean when running multiple commands in sequence.
• -C compresses data during transfer. This reduces bandwidth usage and speeds up transfers over slow connections, though it increases CPU load on both systems.
• -r copies directories recursively, including all subdirectories and files. Without this flag, SCP only copies individual files.

Combine multiple options in a single command. For example, scp -rC copies directories recursively with compression enabled.

Copy files from local to remote

Transferring files from your local system to a remote server uploads content to your VPS or another networked machine. This is the most common SCP operation for deploying files or backing up data to remote storage.

1. Identify your source file path.
   Locate the file you want to transfer on your local system. Note its full path, for example /home/user/website/index.html.
2. Determine the remote destination.
   Decide where the file should go on the remote server. You need the server’s IP address or hostname, your SSH username and the target directory path.
3. Execute the transfer command.
   Run the following command, replacing the paths and credentials with your actual values:

scp /path/to/index.html root@192.168.1.1:/home/public_html

This copies index.html from your local system to the /home/public_html directory on the remote server at 192.168.1.1.

4. Copy an entire directory.
   Add the -r flag to copy a directory and all its contents:

scp -r /path/to/images root@192.168.1.1:/home/public_html

The images directory and everything inside it now exists on the remote server. SCP prompts for your SSH password or uses your SSH key if configured.

Copy files between remote systems

SCP transfers files directly between two remote servers without routing data through your local machine. This saves bandwidth and speeds up transfers when moving data between VPS instances or backup servers.

1. Verify SSH access to both servers.
   Confirm you can SSH into both the source and destination servers. You need valid credentials for both systems.
2. Construct the remote-to-remote command.
   Specify both source and destination as remote paths. Run this command from any system with SSH access to both servers:

scp -r root@192.168.1.1:/home/public_html root@192.168.1.2:/home/public_html

This copies the public_html directory from the server at 192.168.1.1 to the server at 192.168.1.2. The -r flag ensures all subdirectories transfer.

3. Authenticate to both servers.
   SCP prompts for passwords for both the source and destination servers unless you have SSH keys configured. Enter each password when prompted.

The transfer completes without touching your local system. This method works best for large files or when your local connection is slower than the connection between the two remote servers.

Use wildcards for batch transfers

Wildcards let you transfer multiple files matching a pattern in a single command. This reduces repetitive commands when working with groups of related files.

SCP supports two wildcard characters:

• * matches zero or more characters
• ? matches exactly one character

When using wildcards with remote paths, wrap the entire path in double quotes. This forces the remote system to interpret the wildcard rather than your local shell.

This command copies all June 2025 backup files from one server to another:

scp "root@192.168.1.2:/home/backups/backup-2025-06-*.tar.gz" root@192.168.1.3:/home/backups/

The * wildcard matches any characters after backup-2025-06-, capturing files like backup-2025-06-01.tar.gz and backup-2025-06-15.tar.gz. Without quotes, your local system would expand the wildcard before SCP sees it, potentially matching the wrong files.

Further reading on secure file transfers

SCP works well for one-off transfers and simple file copies. For more complex scenarios, rsync offers additional features including incremental transfers, bandwidth limiting and the ability to resume interrupted transfers. Rsync only copies changed portions of files, making it more efficient for large datasets or frequent synchronisation tasks.

Our guide on using the rsync command covers these advanced capabilities. Rsync uses similar syntax to SCP but adds options for excluding files, preserving hard links and showing detailed progress information. Consider rsync when you need to synchronise directories regularly or transfer large files over unreliable connections.

The OpenBSD SCP manual page documents every available option and flag. This reference explains less common features like limiting bandwidth with -l or using IPv6 addresses with -6.

Wrapping up

You now transfer files securely between Linux systems using SCP. You learned command syntax, applied options for recursive copying and compression, and executed transfers between local and remote systems. Your files move encrypted over SSH, protecting data from interception.

Test your commands with non-critical files first. Verify file permissions on the destination system if transfers fail. Review our guides on SSH key management and rsync for advanced transfers. Our VPS hosting includes full SSH access for secure file management.