FTP, FTPS or SFTP? Secure file transfer in practice
FTP has been around since 1971, but without encryption it is no longer safe. We compare FTP, FTPS and SFTP and show modern alternatives.
FTP (File Transfer Protocol) is one of the oldest internet protocols: its first version dates from 1971, and the standard still in use today (RFC 959) is from 1985. Many hosting providers still offer it as the default way to upload files – yet plain FTP is a serious security risk today.
What is wrong with plain FTP?
FTP sends everything – including the username and the password – unencrypted, in readable form across the network. On public Wi-Fi, a compromised router or anywhere along the path, traffic can be intercepted and credentials read with ease. In addition:
- uploaded files can be modified in transit without anyone noticing;
- it uses two separate connections (control and data), which often causes problems behind firewalls and NAT;
- weak or reused FTP passwords are a classic entry point for website compromises.
FTPS: FTP with encryption
FTPS extends FTP with TLS encryption (the same technology that protects HTTPS). It comes in two forms: explicit FTPS starts on the usual port 21 and then upgrades to an encrypted connection, while implicit FTPS is encrypted from the start (typically on port 990). It is secure when configured correctly, but inherits all of FTP's operational difficulties and requires certificate management.
SFTP: the modern default
Despite its name, SFTP is not a variant of FTP but a completely different file transfer protocol built on SSH. Its advantages:
- a single encrypted connection (typically port 22), easy to firewall;
- SSH key authentication can be used instead of passwords, which is far more secure;
- supported by most file transfer clients (FileZilla, WinSCP, Cyberduck) and developer tools.
| Aspect | FTP | FTPS | SFTP |
|---|---|---|---|
| Encryption | None | TLS | SSH |
| Key-based authentication | No | With client certificates | Yes (SSH keys) |
| Ports | 21 + data ports | 21/990 + data ports | 22 |
| Recommended in 2026? | No | If you must | Yes |
What about not uploading files at all?
For websites and web applications, the best option is often not to upload files manually at all. Modern alternatives:
- Git-based deployment: the code lives in a Git repository and is deployed to the server automatically after a push (CI/CD).
- Containers: the application is built as a Docker image; the server only runs the finished image.
- rsync over SSH: fast, copies only changes, encrypted.
Rule of thumb: if a provider only offers unencrypted FTP, treat it as a warning sign about the security level of its entire infrastructure.
Checklist
- Disable unencrypted FTP on your server.
- Use SFTP with SSH keys and disable password login where possible.
- Restrict access to the required directories (chroot).
- Rotate all previous FTP passwords.
- In the long run, move to Git-based, automated deployment.
