FTP: file transfer from the early days of the internet

Older than the internet itself, for decades the standard for downloads and website uploads – and today a security risk if it still runs unencrypted. What FTP is, what replaces it and what to look out for.

Protocol: control and data connection

Control connection TCP 21 with commands USER, PASS, LIST, RETR, STOR; data connection active via port 20 or passive via a high port of the server — Separate connections for commands (21) and data (active 20, passive high port).

FTP (RFC 959) uses a persistent control connection (TCP 21, Telnet-like text commands) and a separate data connection for each transfer or directory listing:

Mode	Flow	Consequences
Active (`PORT`/`EPRT`)	The server connects from port 20 to the client on a port named by the client.	fails with NAT and client firewalls; vulnerable to FTP bounce (abusive `PORT` targets)
Passive (`PASV`/`EPSV`)	The server opens a high port (e.g. 49152–65535) and announces it; the client connects.	server firewall must open the range; stateful firewalls need FTP helpers (ALG), which can no longer read along with TLS

220 ProFTPD Server ready
USER anna
331 Password required for anna
PASS secret123            ← in plain text
230 User anna logged in
EPSV
229 Entering Extended Passive Mode (|||50211|)
RETR backup.zip
150 Opening BINARY mode data connection

History and standards

1971 RFC 114 (Abhay Bhushan, MIT): first specification for the ARPANET.
1980 RFC 765: FTP over TCP/IP.
1985 RFC 959 (Postel, Reynolds): still the basis today.
1994 RFC 1579 "Firewall-Friendly FTP": clients should use passive mode.
1997 RFC 2228 "FTP Security Extensions" (AUTH, PROT, PBSZ).
1998 RFC 2428 (EPRT/EPSV for IPv6 and NAT), RFC 2389 (FEAT).
2001–2006 SFTP as part of SSH-2 in IETF drafts (draft-ietf-secsh-filexfer); never adopted as an RFC, de facto standard in OpenSSH as version 3.
2005 RFC 4217: FTP over TLS (FTPS, "explicit" with AUTH TLS); "implicit" FTPS on port 990 is widespread but not standardised.
2007 RFC 3659: MLSD, MDTM, SIZE (machine-readable listings).
2021 Chrome 88 (January) and Firefox 90 (July) remove FTP support.
2022 OpenSSH 9.0 uses the SFTP protocol for scp by default.

Security

Plain text: credentials and content without TLS; capturing traffic on the network is enough. With web hosting, an FTP account usually means write access to the website.
Brute force: open port 21 is continuously attacked with password lists; without a lockout after failed attempts (e.g. Fail2Ban) it is only a matter of time.
Anonymous FTP: directories that are accidentally readable or even writable.
FTP bounce (abuse of PORT for scans and bypassing filters); modern servers only accept the client IP.
Known vulnerabilities in old servers, such as the backdoor in vsftpd 2.3.4 (2011) or ProFTPD mod_copy (CVE-2015-3306).
FTPS: enforce TLS 1.2/1.3 (TLSRequired), protect the data channel (PROT P), require TLS session reuse on the data channel (protects against hijacking of the data connection).

FTP, FTPS, SFTP, SCP, HTTPS compared

FTP port 21 without TLS, FTPS port 21 with AUTH TLS or 990 with two TCP connections, SFTP port 22 over SSH with one connection — Only FTPS and SFTP encrypt; SFTP needs only one connection.

	FTP	FTPS	SFTP	HTTPS (WebDAV, upload)
Encryption	none	TLS	SSH	TLS
Ports	21 + data	21/990 + data	22	443
Firewall/NAT	difficult	difficult (no ALG)	easy	easy
Authentication	password	password, client certificate	password, key, certificate	password, token, SSO
Recommendation	switch off	only if necessary	standard	for people and APIs

State of play (2026)

Hosting providers and Plesk servers often still offer FTP by default; SFTP is usually available but not always the default.
FTP can still be found in industry and building technology (controllers, cameras), in printers ("scan to FTP") and in old integrations between companies; B2B exchange is dominated by SFTP, AS2 and HTTPS interfaces.
Internet-wide scans still count millions of reachable FTP servers, many with outdated software.
Rules such as PCI DSS require strong encryption in transit for sensitive data; unencrypted FTP does not meet this.

Developments

Moving away from FTP: after the browsers, operating systems and tools are gradually removing support too; hosting providers are switching to "SFTP only".
Post-quantum SSH: OpenSSH uses hybrid key agreements (sntrup761x25519 from 9.0, mlkem768x25519 as default from 10.0); this also protects SFTP against "harvest now, decrypt later".
Managed file transfer and signed, time-limited HTTPS links (e.g. object storage) replace shared FTP accounts.
Deployment of websites via Git, CI/CD and SSH instead of FTP upload.

Hardening, if FTP has to stay

Only FTPS with enforced TLS (control and data channel), no anonymous access, chroot per account.
Define a narrow passive port range and open only that; restrict access by firewall to known addresses.
Lockout after failed attempts (Fail2Ban), strong passwords, no shared accounts, logging.
Keep the server up to date; hide the version in the greeting banner.
In Plesk: "Tools & Settings → FTP settings" or grant only SFTP access per subscription.

What eam.ch checks

In active mode (with authorisation): reachable unencrypted services such as FTP (port 21) as the finding "Unencrypted service reachable".
Versions in service greetings are matched against known vulnerabilities.
Certificates and TLS versions of reachable servers (TLS report).

Sources: RFC 114, 765, 959, 1579, 2228, 2389, 2428, 3659, 4217 (rfc-editor.org); draft-ietf-secsh-filexfer; release notes Chrome 88 and Firefox 90 (2021); OpenSSH release notes 9.0 (2022) and 10.0 (2025); NVD, CVE-2015-3306.

In short

FTP (1971/1985) transfers files over two connections: control on port 21, data separately.
Classic FTP is unencrypted: passwords and files can be read along.
Browsers no longer support FTP since 2021.
Secure successors: SFTP (over SSH, recommended) and FTPS (FTP with TLS).
Switch off FTP services that are not needed; operate devices using FTP only internally.