Guide

FTP and FTPS configuration

FTP and FTPS share a dialog entry. They do not share a security property.

DiagramPick the listener the server actually runs.

Plain FTPPort 21 · not encrypted

Explicit FTPSPort 21, then TLS on both channels

Implicit FTPSPort 990 · TLS from the first byte

Not this doorSFTP is SSH on port 22

In the Login dialog, FTP is the file protocol. TLS is a method on that protocol. SFTP is a separate choice.

The situation

You were given FTP credentials and need the right listener before you type the password. If the note says port 22 or SSH, use the SFTP guide instead.

Prerequisites

Hostname The FTP name, which may differ from the website.
Mode None, explicit TLS, or implicit TLS.
Account Username and password, unless the server is a published anonymous mirror.
Certificate The name you should see when TLS is on.

Choose encryption and connect

File protocol Set FTP.
Plain FTP Leave encryption off only when the password and the files can travel in the clear. Ask for FTPS or SFTP first.
Explicit TLS Usual port 21. This client encrypts the control channel and the data channel for the whole session.
Implicit TLS Usual control port 990 and data port 989. The server expects TLS immediately.
Certificate Continue only when the name and dates match. Anonymous login is only for a published public server.

Passive mode is the usual data connection from a PC behind a router, because active mode asks the server to connect back to you. The FTP page of Advanced Site Settings includes “Force IP address for passive mode connections” for servers behind address translation. Change it only when the administrator describes that failure.

The same page chooses MLSD or older LIST. Leave it on Auto unless you are working around a broken server.

Two example sessions

Explicit: FTP + TLS, ftp.example.com, port 21
Implicit: FTP + implicit TLS, port 990
Plain:    FTP, no encryption, port 21

In scripts, ftpes means explicit TLS and ftps means implicit TLS. Pin a verified certificate with -certificate. Do not accept whatever certificate appears.

Expected result

The remote panel lists the account directory. The protocol line, not the file names, tells you whether the session is protected.

Common mistakes

Calling FTPS “SFTP,” or the reverse.
Using port 990 on an explicit server, or port 21 on an implicit server.
Turning encryption off to clear a certificate warning.
Expecting an SSH key to log in to FTP.

Security

Plain FTP sends the username, password, and files in the clear. FTPS protects them only when the certificate is the right one. A TLS client certificate, if required, belongs in the TLS settings, not in the SSH private-key box.

Troubleshooting

Refused on port 21 against an implicit server often means you never tried 990. Authentication failed after a good certificate is the account. A session that dies when the listing should appear is often the data connection. FTP can resume a broken file. That does not make plain FTP safe.

Winsaip is an independent educational resource and is not affiliated with or endorsed by the developers of WinSCP.