FTP is one of the oldest Internet protocols, and despite being around for over fifty years, it's still used in everyday server work. Webmasters use it to upload files to hosting , administrators to manage backups, and developers to implement changes to production servers. What is FTP, how does it work, and is it still worth using in 2026? Find the answers below.
What does FTP stand for?
FTP stands for File Transfer Protocol . The technical definition of FTP is as follows: it is a standard application layer protocol in the TCP/IP model that allows file transfer between two computers connected by a network. FTP allows you to download and upload files, create directories, rename, and delete resources on a remote server.
FTP is a protocol, not a program – why is it important?
FTP isn't a specific program, but a set of communication rules. Programs like FileZilla Client or WinSCP are merely clients that use these rules to establish connections.
How did the FTP protocol come about?
The first specification for a file transfer protocol was published on April 16, 1971, as RFC 114, by Abhay Bhushan of MIT. FTP was therefore developed before the implementation of TCP/IP – at that time, it operated based on the older NCP (Network Control Protocol) architecture used on the ARPANET.
(The rest of the article can be found below the form)
Over the years, the specification underwent numerous revisions. The groundbreaking document was RFC 765 in 1980, which first described FTP as a protocol based on TCP. The base FTP specification, still in effect today, is RFC 959, published in October 1985 by Jon Postel and Joyce Reynolds. It added, among other things, commands for directory management (MKD, RMD, PWD) and system identification (SYST). This specification was later supplemented by more than a dozen extensions, including RFC 2228 (security mechanisms), RFC 3659 (file metadata extensions), and RFC 4217 (TLS-secured FTP).
What is File Transfer Protocol from a historical perspective? It's one of the oldest protocols, having survived for over half a century—longer than HTTP, SMTP, or DNS in their current versions.
How does the file transfer protocol work?
The FTP protocol is based on a client-server architecture and uses two separate communication channels:
- control channel (default port 21) – used to send commands and receive server responses,
- data channel – in active mode, the server usually initiates it from port 20 to the port indicated by the client; in passive mode, an additional port provided by the server is used.
The control channel remains open during data transfer, allowing control information to be sent—for example, aborting the transfer with the ABOR command. However, operations such as listing a directory and downloading a file are performed sequentially within a single session, because the LIST command also uses the data connection. Programs such as FileZilla Client, which allow browsing directories during an ongoing transfer, accomplish this by opening multiple parallel FTP sessions.
A typical FTP session works as follows. The client connects to the server on port 21 and goes through the authentication process – most often using a login and password. Some servers also allow anonymous logins, using "anonymous" as the username. After logging in, the client sends text commands such as LIST (list directory contents), RETR (download file), or STOR (send file to server). The server responds with numeric codes – for example, 226 indicates successful transfer, while 530 indicates login was denied.
Active mode vs. passive mode
The FTP protocol supports two modes of establishing a data connection, which is important in networks protected by firewalls.
In active mode, the client informs the server on which port it is listening, and the server initiates a return connection, usually from port 20. The problem is that many firewalls block this type of incoming connections - from the firewall's perspective, the server tries to "knock" on the client's computer on its own, which can be interpreted as a threat.
In passive mode, the data connection is initiated in reverse: the server opens an additional port and passes it to the client, which then establishes the connection. This ensures that all communication originates from the client, greatly simplifying firewall configuration. For this reason, passive mode is now the default in most FTP clients.
FTP, FTPS and SFTP – three protocols, three approaches to security
Why is classic FTP dangerous?
The fundamental weakness of traditional FTP is its lack of encryption. All data—including logins and passwords—is transmitted in clear text, making it vulnerable to interception.
For this reason, two more secure solutions are used: FTPS, i.e. FTP secured with TLS, and the independent SFTP protocol.
FTPS (FTP over TLS) – extends the classic FTP protocol with a TLS encryption layer . This allows both the control and data channels to be encrypted. FTPS still uses a separate data connection for each transfer. In passive mode, this requires the firewall to open the appropriate port range, complicating configuration.
SFTP (SSH File Transfer Protocol) is a protocol built on top of SSH (Secure Shell), and therefore technically distinct from FTP. It uses a single port (22 by default), encrypts all communication, and supports public key authentication. An SFTP client cannot connect to an FTPS server and vice versa – despite their similar names, these are two completely different mechanisms.
Which option should you choose? SFTP is usually the simplest, secure operational choice – a single port, mandatory encryption, and a lower risk of misconfiguration, especially when SSH infrastructure is already in place. FTPS with properly implemented TLS and certificate validation provides a comparable level of protection but requires more careful network configuration. Unencrypted FTP should also be avoided on internal networks, as even there, there is a risk of interception of login credentials transmitted in plaintext. Exceptions may be made for tightly controlled legacy systems with network segmentation and additional security measures.
Where is FTP used in practice?
Although the number of internet hosts with a visible FTP service is decreasing – according to Censys data from April 2026, it is around 5,95 million, compared to over 10,1 million two years earlier – the protocol still serves certain functions.
The most common uses include:
- file management on hosting – uploading themes, plugins and configuration files for WordPress or other websites CMS systems,
- website migration – transferring files between servers when changing hosting provider,
- creating backups – automatic download of database and website file backups,
- distribution of large files – in corporate environments, FTP is sometimes used to send graphic materials, video recordings or technical documentation,
- CI/CD processes – some older automated deployment systems still use FTP to publish changes to the server.
It's worth remembering, however, that modern approaches to server file management increasingly rely on deploying changes from a Git repository via CI/CD systems, transferring them via rsync or SCP, or using file managers built into hosting panels. In many scenarios, these tools replace the traditional FTP protocol.
Popular FTP client programs
FTP requires a client program. Here are some of the most popular tools in 2026.
- FileZilla Client – a free, open-source client available for Windows, macOS, and Linux. It offers a two-pane interface (local files on the left, remote files on the right), FTP, FTPS, and SFTP support, and transfer queuing. It's the most recommended program for those just starting out with FTP.
- WinSCP – a free client for Windows, appreciated for its advanced security features and ability to automate tasks via scripts. It supports FTP, SFTP, SCP, and WebDAV, and its integration with PuTTY simplifies the work of server administrators.
- Cyberduck – a client available for macOS and Windows, featuring integration with popular cloud services (Google Drive, Dropbox, Amazon S3). It's especially useful for users who need access to cloud resources in addition to FTP.
- Transmit – a paid macOS app, appreciated for its speed and refined interface. It supports FTP, SFTP, WebDAV, and numerous cloud protocols. It's a popular choice for professional web developers working in the Apple environment.
Does FTP make sense in 2026?
What is FTP from today's perspective? It's primarily a protocol with a long history, one that, despite its limitations, remains present in the internet infrastructure. Censys data indicates that of the nearly 6 million hosts with a visible FTP service, only about 59% observed a completed TLS handshake. The absence of such a handshake on the remaining approximately 2,45 million hosts doesn't automatically prove a lack of encryption support, but it does indicate the potential risk of transmitting data in plaintext.
FTP won't disappear overnight, as too many systems and processes still rely on it. However, SFTP is currently one of the most widely recommended secure file transfer methods, and unencrypted FTP is gradually being phased out.
Which protocol to choose in 2026?
If you're setting up a new server or configuring hosting access, SFTP should be your first choice. It's worth retaining the traditional file transfer protocol only where legacy systems require it, while also implementing network segmentation and access controls.
FTP FAQs
FTP (File Transfer Protocol) is used to transfer files between networked computers. It allows users to download and upload files, create directories, rename, and delete resources on a remote server. It is most commonly used by webmasters to upload files to hosting, administrators for backups, and developers to implement changes.
FTP transfers data in clear text and uses two separate channels (ports 21 and 20). SFTP is a protocol built on top of SSH, technically separate from FTP—it uses a single port (22 by default), encrypts all communications, and supports public-key authentication. Despite the similar name, an SFTP client won't connect to an FTP or FTPS server.
Classic FTP is not secure—logins, passwords, and files are transferred in clear text, making them vulnerable to interception, even within the internal network. Secure alternatives include FTPS (TFP secured with TLS) and SFTP (based on SSH). Unencrypted FTP is best avoided these days, and if possible, switched to SFTP.
Classic FTP uses two ports: the control channel runs on port 21 by default, and the data channel runs on port 20 in active mode (and on an additional port provided by the server in passive mode). SFTP, on the other hand, uses a single port—22 by default, the same as SSH.
In active mode, the server initiates the data connection to the client, which is often blocked by firewalls. In passive mode, the client establishes the connection, so all communication originates from the client and is easier to pass through the firewall. Therefore, passive mode is the default mode in most FTP clients today.
For beginners, the most frequently recommended free FileZilla Client (Windows, macOS, Linux) supports FTP, FTPS, and SFTP. WinSCP is suitable for Windows administrators thanks to script automation, Cyberduck integrates with cloud storage (Google Drive, Dropbox, Amazon S3), and Transmit is a highly regarded paid app for macOS.
Yes, although its role is diminishing—the number of hosts with a visible FTP service has fallen to about 5,95 million, according to Censys, from over 10,1 million two years earlier. FTP is still used for file management on hosting, migrations, and backups, but in newer implementations, it's being replaced by SFTP, rsync, and Git repository deployments.
Summary
The above article covers the following topics:
- Expansion of the FTP abbreviation and definition of the file transfer protocol.
- The history of FTP from RFC 114 in 1971 to the current RFC 959 specification.
- Principle of FTP operation in the client-server model, the role of the control channel and data channel, and the difference between active and passive mode.
- Differences between FTP, FTPS and SFTP and their approach to data encryption.
- Practical applications of FTP: hosting, site migrations, backups and file distribution.
- Popular FTP clients: FileZilla, WinSCP, Cyberduck, and Transmit.
- Evaluation of the usefulness of FTP in 2026 and recommendation to switch to SFTP.
