FTP (File Transfer Protocol) is a network protocol for transferring files between computers over a TCP/IP network. It allows files to be uploaded or downloaded between a local computer and a remote server, and is used to this day by web developers and administrators to transfer files to web servers.
How does FTP work?
FTP follows the client-server model and, unusually, uses two separate connections:
- Control channel (control connection, port 21): commands like login, directory changes or file list requests run over this channel.
- Data channel (data connection): the actual files are transferred over a separate channel.
How this second channel is established differs between two modes:
- Active mode: the server actively opens the data connection back to the client – frequently fails in practice at the client’s firewalls and NAT.
- Passive mode: the client opens both connections itself. Considerably more reliable behind firewalls and therefore the default in most FTP clients today.
The main FTP variants at a glance
| Variant | Encryption | Basis | Note |
|---|---|---|---|
| FTP | None | A standalone protocol | Credentials and files in plain text, outdated |
| FTPS | TLS/SSL | Classic FTP + encryption | Separate control and data channels like the original |
| SFTP | SSH | A fully independent protocol | Despite the similar name, technically not FTP |
FTP vs. FTPS vs. SFTP: security in focus
Pure FTP transfers both credentials and file contents unencrypted – anyone recording the traffic, say in an open Wi-Fi network, can read username and password directly in plain text. For any transfer over the open internet, an encrypted alternative is therefore mandatory:
- FTPS (FTP Secure): extends the classic FTP protocol with TLS/SSL encryption but keeps the original two-channel logic.
- SFTP (SSH File Transfer Protocol): runs completely over a single SSH connection. Despite the similar name, technically a standalone protocol that has nothing to do with the original FTP – in practice often the more robust choice, because no separate data port is needed.
When are FTP/FTPS still used today?
For new, self-controlled server infrastructure, SFTP is usually the preferred choice today. In practice, though, many shared and reseller hosting environments, say, classic web hosting packages behind control panels like Plesk – deliberately offer no SSH access, only FTPS as write access to the webspace. For agencies and developers, handling FTPS securely therefore remains practically relevant craft to this day, even if SFTP is technically the more modern variant.
FTP clients and automation
For manual use, graphical FTP clients like FileZilla, Cyberduck or WinSCP suffice. For recurring transfers, say, as part of a website deployment – automation pays off: scripts or CI/CD pipelines then handle the file upload reliably and without manual operation, avoiding errors from forgotten or wrongly uploaded files.
Conclusion
FTP is one of the oldest still-active internet protocols, and precisely for that reason a good example of how security requirements have evolved over decades. Pure, unencrypted FTP has no place in professional use any more; FTPS and SFTP have rightly displaced it. We’re happy to support you with securely setting up file transfers, hosting environments and automated deployments as part of our maintenance and security services or simply get in touch and we’ll take a look together.