Install lftp

On the new server — the one you're pulling to:

sudo apt install lftp      # Debian / Ubuntu
sudo dnf install lftp      # Fedora / RHEL-alikes

Seed the known-hosts file

Make one SSH connection first so that the old server's host key is accepted and cached — otherwise lftp prompts for it mid-mirror and timeouts can happen:

ssh root@oldsite.com
# type 'yes' to the fingerprint prompt, then exit

Run the mirror

lftp -u USER,PASSWORD sftp://oldsite.com <<'EOF'
set sftp:auto-confirm yes
set mirror:parallel-transfer-count 8
mirror --verbose --continue /var/www /var/www
quit
EOF

Parameters worth knowing:

  • --continue — resume any partially transferred files. If the link drops, re-run the same command and pick up where you left off.
  • --parallel=N (or mirror:parallel-transfer-count) — transfer N files concurrently. 4 to 8 is usually the sweet spot before the remote SFTP server starts throttling.
  • --no-perms — skip chmod on the destination. Useful when the user ID mappings differ between the two servers.
  • --exclude-glob .git/, --exclude-glob node_modules/ — skip directories you don't need.
  • --delete — mirror should also remove files on the destination that don't exist on the source. Only after you've done a dry run with --dry-run.

Key-based auth instead of a password

If the old server already has your SSH public key authorized, skip the password entirely:

lftp -u root, -e "set sftp:connect-program 'ssh -a -x -i ~/.ssh/id_ed25519'" sftp://oldsite.com <<'EOF'
mirror --verbose --continue /var/www /var/www
quit
EOF

The empty password (-u root,) combined with sftp:connect-program tells lftp to use SSH's own key lookup.

When to reach for something else

rsync — still the right tool when you can run it on both ends. Does incremental sync better than lftp mirror, handles sparse files and hardlinks, and is the standard for repeated syncs (as opposed to one-shot migrations). rsync -avzP --rsync-path="sudo rsync" root@oldsite:/var/www/ /var/www/

tar + ssh pipe — best raw speed when you have good bandwidth and you want one big stream. ssh oldsite "tar -C /var/www -cf - ." | tar -C /var/www -xf -. No resumability, though.

restic / borg backup — if the goal is "I want this data safe and restorable," a proper backup tool gives you deduplication, encryption, and a catalog. Worth setting up before you start depending on the new VPS.

For a one-off migration where the source is an arbitrary SFTP account and you just want a faithful copy? lftp mirror is usually the least total effort.