FTP: file transfer from the early days of the internet
Older than the internet itself, for decades the standard for downloads and website uploads – and today a security risk if it still runs unencrypted. What FTP is, what replaces it and what to look out for.
What is FTP?
FTP stands for File Transfer Protocol. It is used to download files from a server or upload files to a server – in the past, for example, programs, drivers or the files of your own website.
FTP works with two lines: over one, the computer and the server talk to each other ("I am Anna, my password is …", "Show me the folder", "Give me this file"). The file itself flows over the second one.
A short history
- 1971 Abhay Bhushan describes FTP for the ARPANET – before e-mail standards and long before the World Wide Web.
- 1985 The version still valid today is published.
- 1990s FTP is the way to distribute software. Many servers allow "anonymous" FTP without an account of your own.
- 2000s Hosting providers offer FTP for uploading websites. At the same time, secure successors appear: FTPS (FTP with encryption) and SFTP (file transfer over SSH).
- 2021 Chrome and Firefox remove FTP. Links starting with
ftp://no longer open in the browser. - Today FTP lives on mainly in older devices and processes, such as scanners, machines or old website tools.
The problem: everything in plain text
Classic FTP transmits user name, password and files unencrypted. Anyone listening on the same network – on public Wi-Fi, at the provider or via a hacked router – can read everything. Particularly sensitive: an FTP password often allows changing the entire website, for example to inject malware.
On top of that come constant attacks: bots try passwords on open FTP services around the clock, and old FTP servers have known vulnerabilities.
The secure successors
- FTPS is FTP with encryption (like the S in https). It keeps the two lines and is therefore awkward for firewalls.
- SFTP has only the name in common with FTP: it runs over SSH, the secure connection for remote server administration, needs only one line and can use keys instead of passwords. This is today's recommendation.
- For sharing with people, encrypted exchange platforms or cloud shares with an expiry date are better suited than a server.
FTP today
- Browsers can no longer do FTP; you need a separate program (e.g. FileZilla, WinSCP).
- Many hosting providers offer SFTP alongside FTP – often FTP is only switched on out of habit.
- Devices such as multifunction printers ("scan to FTP"), cameras or production controllers still send via FTP. This should only happen on the internal network, never over the internet.
- Almost all public download archives have switched to HTTPS.
What is coming
- Unencrypted FTP continues to disappear. New systems rely on SFTP or HTTPS.
- SFTP is also becoming more modern: SSH is switching to methods that will withstand future quantum computers.
- Automated processes between companies increasingly run via interfaces (APIs) instead of files on a server.
What you can do
- Check whether FTP is still open on your website or at your hosting provider, and switch it off if nobody needs it.
- Use SFTP for uploads, preferably with a key instead of a password.
- Operate devices that send via FTP only internally and shield them from the internet.
- Have your own domain checked from the outside: open FTP services stand out.
In short
- FTP (1971/1985) transfers files over two connections: control on port 21, data separately.
- Classic FTP is unencrypted: passwords and files can be read along.
- Browsers no longer support FTP since 2021.
- Secure successors: SFTP (over SSH, recommended) and FTPS (FTP with TLS).
- Switch off FTP services that are not needed; operate devices using FTP only internally.