What is FTP?

File Transfer Protocol dates from the early internet and is still found on web hosts, network appliances, printers, industrial equipment and backup jobs. The control connection listens on TCP port 21, with data carried on a separate connection — port 20 in active mode, or a negotiated high port in passive mode, which is why FTP interacts awkwardly with firewalls and NAT.

The core problem

FTP has no encryption. Usernames, passwords and file contents cross the network in cleartext, readable by anyone on the path, and there is no integrity protection to detect tampering. That alone makes it unsuitable for internet use with any credential you care about.

Two further issues are common in practice. Anonymous FTP, enabled by default on some servers, permits access without credentials — occasionally intentionally for public downloads, more often by oversight, and sometimes with write access to a directory. And FTP daemons on embedded devices are frequently old, unmaintained, and carrying known CVEs with the version advertised openly to banner grabbing.

What to check and what to use instead

Externally, the questions are whether port 21 is open at all, whether anonymous login is accepted, whether write access is possible, and what the banner reveals about the server software and version.

The replacements are SFTP, which runs over SSH and needs only port 22, or FTPS, which wraps FTP in TLS. SFTP is generally simpler to firewall and to operate. For genuinely public file distribution, HTTPS over a web server or object storage is a better fit — though see S3 bucket exposure for how that can go wrong too.

Related concepts

FTP belongs with telnet among plaintext legacy protocols that survived on devices rather than servers. See also default credentials, security misconfiguration and attack surface reduction.