Automate SFTP Uploads and Downloads with WinSCP Scripting

Publication Date: December 9, 2020

Updated: July 29, 2026

Overview

Create an automatic file download and upload tool using the WinSCP command. Execute the commands provided by WinSCP using the command prompt. Not surprisingly, WinSCP provides a command. You usually use "WinSCP.exe", but "WinSCP.com" is also available. Since you usually open the folder from the shortcut, you will almost never see the "C:\Program Files (x86)\WinSCP" folder in the shortcut destination, but if you look at the shortcut destination, "WinSCP.com" should be stored there as well. This is where we will create the tool.

1. What is the WinSCP command?

The WinSCP command is a command that allows you to perform the WinSCP operations that you normally perform in the GUI. This operation, which is usually performed on the screen, is executed by command.

1-1. Supported automation

WinSCP scripts can upload and download files, create directories, synchronize content, and invoke supported remote commands.

Commands that may be used frequently are as follows

open — Used for connection.

get — Used to download files.

put — Used to upload files.

exit — Used for cutting.

1-2. Limits of WinSCP scripting

Basic file downloads and uploads are possible, but after using the system, it seems difficult to control the details.

For example, it seemed difficult to do something like "check the modified date of a file and fetch a file with a specified modified date.

Complex file-selection logic may require a local batch or PowerShell wrapper, or a carefully reviewed remote command invoked with call. Treat command arguments as untrusted input and quote them for the target shell.

2. Automatic Download Tool

The first tool automatically downloads log files from a Linux server.

2-1. making

Create a tool with the following conditions

• Execution environment is Windows 10

• The destination server is Linux

• IP address is 192.168.50.10

First, create a bat file that will serve as the starting point for the startup.

@setlocal enabledelayedexpansion

@set time2=%time: =0%

@set MKDIR_NAME=%date:~0,4%%date:~5,2%%date:~8,2%%time2:~0,2%%time2:~3,2%%time2:~6,2%

@set FOLDER=%~dp0%MKDIR_NAME%

@mkdir %FOLDER%

@"C:\Program Files (x86)\WinSCP\WinSCP.com" /console /script=%~dp0ftp.txt /parameter %FOLDER% 

Except for the last line, the rest of the process is a Windows command. Contents.

@setlocal enabledelayedexpansion

This is a setting for delayed environment variables. Simply put, it is a statement that prevents a value from being set to a variable that may not be reflected.

@set time2=%time: =0%

@set MKDIR_NAME=%date:~0,4%%date:~5,2%%date:~8,2%%time2:~0,2%%time2:~3,2%%time2:~6,2%

@set FOLDER=%~dp0%MKDIR_NAME%

The process of obtaining yyyymmddhmmss from the current time and finally putting it into the FOLDER variable.

@mkdir %FOLDER%

Create a folder "yyyymmddhmmss" directly under the folder where the batch was executed.

@"C:\Program Files (x86)\WinSCP\WinSCP.com" /console /script=%~dp0ftp.txt /parameter %FOLDER% 

Run "WinSCP.com (WinSCP command)". The execution executes the commands listed in "ftp.txt" in the same folder where the batch file is stored. Pass the folder path you just created as an argument.

This completes the creation of the caller file. Then, the WinSCP command is described in "ftp.txt".

option batch on

option transfer binary

open test:testpassword@192.168.50.10

get /var/log/httpd/access_log %1%\

close

exit

Contents.

option batch on

In batch mode, interactive prompts use their scripted default. The option shown here suppresses confirmation and can overwrite files with duplicate names, so test the exact transfer in a disposable directory first. (I will create a folder "yyyymmddhmmss" and put it there, so there will be no duplication of file names.)

option transfer binary

The setting is to transfer in binary mode.

open test:testpassword@192.168.50.10

User Name:Password@IP Address". Connect to IP address "192.168.50.10".

get /var/log/httpd/access_log %1%\

Store "/var/log/httpd/access_log" in the "yyyymmddhhmmss" folder. (%1%" is the argument passed in file_get.bat)

Wildcards are supported. For example, /var/log/httpd/* selects every matching entry in that directory; it is a wildcard pattern, not a regular expression.

close

exit

This is a cutting process.

This completes the creation of the tool.

2-2. implementation preparation

Prior to execution, the fingerprints are checked in advance.

An interactive first connection asks whether to trust the server's host key and can cache the decision in the Windows registry. Automation should not trust an unknown key interactively. Obtain the expected fingerprint through an independent channel and pass or configure that exact value before the first unattended run.

"C:\Program Files (x86)\WinSCP\WinSCP.com"

open test:testpassword@192.168.50.10　⇒Enter "y" when prompted for a response

close

exit

exit

The historical example embeds username:password@IP-address in the session URL. Do not keep production credentials in a batch file or command line; use a protected WinSCP configuration or another supported secret source.

This completes the preliminary preparation.

2-3. execution (e.g. program)

Now it's time to execute. Double-click "file_get.bat".

If the folder "yyyymmddhhmmss" is created and the log is stored in the folder, it is successful.

3. Automatic Upload Tool

Next, create an upload tool using the same basic structure as the download tool.

3-1. making

Create a tool with the following conditions

• Execution environment is Windows 10

• The destination server is Linux

• IP address is 192.168.50.10

First, create a bat file that will serve as the starting point for the startup.

@setlocal enabledelayedexpansion

@set FOLDER_NAME="put_files\*"

@set FOLDER=%~dp0%FOLDER_NAME%

@set PUT_FOLDER="/tmp/"

@"C:\Program Files (x86)\WinSCP\WinSCP.com" /console /script=%~dp0put_ftp.txt /parameter %FOLDER% %PUT_FOLDER%

The upload example sends files from the local put_files directory beside the batch file to /tmp/ on the remote host. The transfer commands are stored in put_ftp.txt.

option batch on

option transfer binary

open test:testpassword@192.168.50.10

put %1% %2%

close

exit

The put %1%\ %2% line uploads the source path and destination directory passed to the script as arguments.

3-2. implementation preparation

Verify the expected host-key fingerprint independently before running the upload job. A previously cached key is not a substitute for confirming that it is the correct server key.

Execute the following command at the command prompt

"C:\Program Files (x86)\WinSCP\WinSCP.com"

open test:testpassword@192.168.50.10　⇒Enter "y" when prompted for a response

close

exit

exit

As above, the embedded credential is retained only as a historical example and should be replaced with protected credential handling.

This completes the preliminary preparation.

3-3. execution (e.g. program)

Now it's time to execute. Double-click "file_put.bat".

If the files stored in "put_files" are transferred to the "/tmp/" folder, it is a success.

4. Other commands that may be used frequently

The following WinSCP commands are also useful in automated transfers.

4-1. key authentication

Earlier, I logged in with password authentication using the following description.

open test:testpassword@192.168.50.10

open username:password@IP address". In the case of key authentication, the following applies

open test@192.168.50.10 -privatekey=id_rsa.ppk

The "-privatekey=id_rsa.ppk" is the path to the key. Since the paths are relative, it is assumed that the key (id_rsa.ppk) is also in the folder where the executable (bat file) is located. For example, if the key is located directly under the C drive, write "-privatekey=C:\id_rsa.ppk

4-2. Shell Calls

To invoke the shell using the WinSCP command, write as follows

option batch on

option transfer binary

open test:testpassword@192.168.50.10

call sh /tmp/test.sh

close

exit

call sh /tmp/test.sh" will execute "test.sh". It is also possible to pass arguments. When passing arguments, write something like "call sh /tmp/test.sh param1".

5. Conclusion

WinSCP scripting can replace repeatable GUI transfers. A production job should verify the host key, protect credentials, constrain source and destination paths, record exit status, and handle partial transfers and retries.

Official references

• WinSCP scripting documentation
• WinSCP host-key verification
• WinSCP result and exit-code handling