{"id":84407,"date":"2025-03-21T16:18:50","date_gmt":"2025-03-21T16:18:50","guid":{"rendered":"https:\/\/mailrelay.com\/glosario\/ftp\/"},"modified":"2026-10-02T13:42:55","modified_gmt":"2026-10-02T13:42:55","slug":"ftp","status":"publish","type":"glossary","link":"https:\/\/mailrelay.com\/en\/glossary\/ftp\/","title":{"rendered":"FTP"},"content":{"rendered":"\n

FTP is a protocol that lets you upload, download and organize files between a computer and a server connected to a network. The acronym stands for File Transfer Protocol<\/em>, and it has long been closely tied to managing websites, servers and backups. Classic FTP does not encrypt the connection, so today it is best reserved for controlled environments, or replaced with SFTP or FTPS whenever credentials or sensitive information are involved.<\/p>\n\n

You may have come across FTP credentials when signing up for web hosting or asking for technical access to a website. Although the name sounds specialized, the idea is simple: you open a program, identify yourself to the server and move files from one location to another, almost as if you were working with two folders on your computer.<\/p>\n\n

That simplicity, however, should not hide the most important part: choosing the right protocol and limiting permissions. In this guide you will see how FTP works, what it is used for, what risks it carries and which alternative fits each situation.<\/p>\n\n

<\/p>\n\n

What Is FTP?<\/h2>\n\n

FTP is an application-layer protocol that defines how two systems exchange files over a TCP\/IP network. In this context, a protocol is a set of shared rules: it sets out how the connection is started, how a user is authenticated and which commands let you list, upload, download, rename or delete files.<\/p>\n\n

Its design follows the client-server model. The FTP server stores the files and waits for connections; the FTP client is the program where you enter your credentials and run operations. FileZilla, WinSCP and Cyberduck are well-known examples, although you can also connect from a terminal or through automated processes.<\/p>\n\n

The protocol was born when the internet was a very different environment from today’s. The specification has evolved, but the conventional version still sends data and credentials unencrypted. That legacy explains both its wide compatibility and a good share of its limitations.<\/p>\n\n

How Does an FTP Connection Work?<\/h2>\n\n

Unlike other protocols that handle all communication over a single channel, this system separates instructions from the transfer itself. First, the client locates the server using a hostname or an IP address. Then it opens a session, sends the username and password and, if authorized, can work within the directories assigned to it.<\/p>\n\n

The server interprets commands such as listing a folder, retrieving a file or storing a new one. To complete the operation, it uses one control connection and one data connection. This separation is useful, but it also complicates the configuration of firewalls and networks with network address translation.<\/p>\n\n

The Control Channel and the Data Channel<\/h3>\n\n

The control channel is usually established on TCP port 21. It stays open during the session and carries commands and responses, but not the main content of the file. The transfer travels over a separate data channel.<\/p>\n\n

In active mode, the server initiates that second channel toward the client and traditionally uses port 20 as the source. In passive mode, the server announces an available port and the client is the one who opens the data connection. The latter option works better on many modern networks because it keeps the user’s computer from having to accept an unexpected incoming connection.<\/p>\n\n

Authentication and Permissions<\/h3>\n\n

An FTP account usually includes a host, username, password and port. The administrator can restrict it to a specific directory and allow only certain actions. That way, an agency could access a website’s folder without seeing other projects hosted on the same server.<\/p>\n\n

There is also anonymous FTP, which lets people in without a personal account and usually limits access to public downloads. It was common in software and documentation repositories; today it is less frequent because the web and storage services offer more convenient options.<\/p>\n\n

What Is FTP Used for in a Business?<\/h2>\n\n

FTP is useful when you need to move many files, preserve their folder structure or work directly on a server. Unlike an email attachment, it can resume some interrupted transfers, manage remote directories and handle batches without necessarily compressing them into a single package.<\/p>\n\n

The protocol appears mainly in technical tasks, but its effects reach marketing, design, operations and e-commerce.<\/p>\n\n

Publishing and Maintaining a Website<\/h3>\n\n

A classic use is uploading HTML files, stylesheets, scripts, images or documents to the hosting account. It also lets you download a theme to review it, replace a damaged resource or check an error log when the admin panel is unavailable.<\/p>\n\n

On WordPress, FTP access can help you manually deactivate a plugin that is breaking the site, rename a folder or recover a file. It is best to do this with a backup first and, whenever your provider allows it, over SFTP.<\/p>\n\n

Moving Backups and Heavy Resources<\/h3>\n\n

An organization can send backups from one server to another, deliver audiovisual material to a collaborator or pick up exports generated by an internal system. The protocol supports these workflows, but size does not remove the need for encryption: the more valuable the data, the more sense it makes to use a secure variant.<\/p>\n\n

And a finished transfer does not, by itself, mean a verified copy.<\/p>\n\n

Checking the size, the date, a hash or the task log helps you detect incomplete files and failed automations. A serious backup policy also needs versioning, retention and restore tests.<\/p>\n\n

Exchanging Files with Legacy Applications<\/h3>\n\n

Some ERPs, industrial equipment, print shops and supplier systems still generate or collect files over FTP. Replacing that integration can take time, so many companies keep the service behind a private network, a VPN or strict access controls while they prepare the migration.<\/p>\n\n

Here the age of the system matters less than its actual exposure. An isolated, monitored server is a very different scenario from an FTP server open to the internet with a password that has been shared for years.<\/p>\n\n

FTP, SFTP and FTPS: Differences You Should Know<\/h2>\n\n

The three names look alike, but they do not describe the same technology. SFTP is not a version of FTP: it runs over SSH and uses a single encrypted channel. FTPS, on the other hand, does extend FTP with TLS, so it keeps its logic of separate connections and usually requires more careful firewall configuration.<\/p>\n\n

Option<\/th>Encryption<\/th>Usual port<\/th>Channels<\/th>When it fits<\/th><\/tr><\/thead>
FTP<\/td>Not in its standard version<\/td>21 for control; 20 in certain active flows<\/td>Separate control and data<\/td>Isolated networks, legacy compatibility or public information<\/td><\/tr>
SFTP<\/td>Yes, via SSH<\/td>22<\/td>A single channel<\/td>Web administration, automations and secure transfers<\/td><\/tr>
FTPS<\/td>Yes, via TLS<\/td>21 in explicit mode or 990 in implicit mode, plus data ports<\/td>Separate control and data<\/td>Systems that need to stay compatible with FTP and add TLS certificates<\/td><\/tr><\/tbody><\/table><\/figure>\n\n

If your provider offers SFTP, it is usually the most straightforward choice for managing a website. FTPS may be a better fit when the infrastructure already depends on FTP, certificates and existing corporate rules. Unencrypted FTP should be a justified exception, not the configuration you accept by default.<\/p>\n\n

Is It Safe to Use FTP?<\/h2>\n\n

Traditional FTP does not protect the username, the password or the content as they cross the network. Anyone able to observe the traffic could read them. In addition, an account with excessive permissions magnifies the impact of a stolen credential or a human error.<\/p>\n\n

To reduce risks, apply these measures:<\/p>\n\n

    \n
  1. Prefer SFTP or FTPS and disable plain FTP if no application needs it anymore.<\/li>\n\n\n\n
  2. Create a separate account for each person or integration, with access only to the necessary folders.<\/li>\n\n\n\n
  3. Use long, unique passwords; when SFTP allows it, consider SSH key authentication.<\/li>\n\n\n\n
  4. Restrict access by IP, VPN or private network when the workflow is predictable.<\/li>\n\n\n\n
  5. Avoid storing unprotected credentials in scripts, emails, shared documents or screenshots.<\/li>\n\n\n\n
  6. Review the logs, remove inactive accounts and set up alerts for repeated attempts or anomalous transfers.<\/li>\n\n\n\n
  7. Keep the server and the client up to date, and verify backups before modifying production files.<\/li>\n<\/ol>\n\n

    But encryption does not fix poor permission management. An SFTP connection with a shared administrator account is still too wide a door.<\/p>\n\n

    How to Connect to an FTP Server Step by Step<\/h2>\n\n

    Before you start, confirm with your provider whether you should select FTP, explicit FTPS, implicit FTPS or SFTP. The term “FTP access” is sometimes used generically, even when the credentials actually belong to one of the secure protocols.<\/p>\n\n

      \n
    1. Install a reliable, up-to-date client, such as FileZilla, WinSCP or Cyberduck, from its official website.<\/li>\n\n\n\n
    2. Gather the host, username, password, port and protocol specified by the administrator.<\/li>\n\n\n\n
    3. Create an entry in the client’s site manager; avoid quick connect if the program needs to save a secure, recurring configuration.<\/li>\n\n\n\n
    4. Select the correct protocol and validate the SSH fingerprint or the TLS certificate. If an unexpected warning appears, check it before accepting it.<\/li>\n\n\n\n
    5. Connect and locate the two work areas: your local files and the server’s directories.<\/li>\n\n\n\n
    6. Make a copy of the file you are going to change and, if it is your first time connecting, test with a non-critical file first.<\/li>\n\n\n\n
    7. Transfer the content, review the error queue and confirm that permissions, size and location are correct.<\/li>\n\n\n\n
    8. Close the session when you finish and delete the credentials if you worked from a shared computer.<\/li>\n<\/ol>\n\n

      The interface usually lets you drag files from one panel to the other. Even so, look carefully at the remote path: overwriting a file of the same name in the wrong folder is one of the easiest mistakes to make.<\/p>\n\n

      How to Choose an FTP Client<\/h2>\n\n

      The best application is not necessarily the one with the most buttons. For occasional use, look for a clear interface, SFTP and FTPS support, a protected site manager and a queue that lets you resume transfers. If you manage several servers, you will also want directory comparison, bookmarks, speed limits and exportable logs.<\/p>\n\n

      FileZilla works on several operating systems and is familiar to many teams. WinSCP is geared toward Windows and combines file transfer with script-based automation. Cyberduck offers a simple experience on Windows and macOS and supports a variety of storage services.<\/p>\n\n

      Always download the client from its official site and review the installer options.<\/p>\n\n

      For recurring processes, a graphical interface may fall short. Command-line tools and programming libraries let you schedule transfers, validate results and notify you of failures. In that scenario you must protect the keys, log each run and design retries that do not duplicate or corrupt files.<\/p>\n\n

      How FTP Relates to WordPress and Email Marketing<\/h2>\n\n

      FTP does not send newsletters or replace an email marketing platform. Its role is in web infrastructure: you can use it to manage templates, pages, images or downloadable files that support a campaign. After that, the form, the plugin or an API integration takes care of bringing the subscriber’s authorized data into the mailing tool.<\/p>\n\n

      Imagine you publish a guide on your website. Over SFTP you upload the PDF and fix the page’s resources; with a form you collect consent; and from Mailrelay<\/a> you send the delivery, a welcome sequence and segmented campaigns. Each technology solves a different part of the process.<\/p>\n\n

      At Mailrelay we offer you simple automations, segmentation, custom fields, A\/B tests and real-time statistics with click maps. Our free account lets you send up to 80,000 emails per month to a maximum of 20,000 contacts, and includes multilingual technical support by phone, chat and tickets. You can also connect your website through the WordPress plugin or build your own workflows with the Mailrelay REST API<\/a>.<\/p>\n\n

      A Practical Workflow Without Mixing Functions<\/h3>\n\n

      Your web team can publish the content over SFTP and check that the URL works. Marketing then creates the form and defines which field or group each signup will go to. The email platform triggers the right message and records opens, clicks, unsubscribes and bounces so you can evaluate the campaign.<\/p>\n\n

      If you are going to import a database from a file hosted on a server, add checks before sending. You must verify the origin of the contacts, the applicable consent, the file’s encoding and the field mapping. You can expand on the strategic side in this guide to online mailing and campaign resources<\/a>.<\/p>\n\n

      Common FTP Errors and How to Interpret Them<\/h2>\n\n

      A connection failure does not always mean the server is down. “Connection timed out” usually points to an incorrect host, a closed port, a firewall or an incompatible data mode. Try passive mode if the session starts but the folder listing hangs.<\/p>\n\n

      The “authentication failed” message normally indicates that the username or password do not match, although it can also appear if the account has expired or if you try to use FTP where the server requires SFTP. Copy the credentials without spaces, check capitalization and confirm the protocol.<\/p>\n\n

      A permissions error appears when you can log in but cannot create, delete or overwrite. Instead of widening the whole account’s access, ask the administrator to review the file’s ownership and grant only the necessary operation.<\/p>\n\n

      Interruptions during large files can be due to an unstable connection, time limits or lack of space. Resume the transfer if the client and server allow it, compare the final size and check the log. Blindly repeating the upload can leave partial or duplicate versions.<\/p>\n\n

      When to Use FTP and When to Choose Another Option<\/h2>\n\n

      The original protocol can still fit in an isolated internal network, a public download with no sensitive information or a legacy integration protected by additional controls. Its compatibility and the number of tools available explain why it is still around.<\/p>\n\n

      For managing hosting over the internet, SFTP usually offers a cleaner solution. If you need to share documents with non-technical people, a collaborative space with links, versions and visible permissions may be more convenient. And when two applications must exchange structured data in real time, an API provides validation and responses that a simple file cannot.<\/p>\n\n

      To decide, start with what your workflow needs: confidentiality, traceability, automation, collaboration, compatibility or handling large volumes. That answer will lead you to the right mechanism, regardless of whether FTP is considered a veteran technology.<\/p>\n\n

      Conclusion<\/h2>\n\n

      FTP remains a recognizable piece of server administration: it lets you transfer and organize files through a client and a server, with separate channels for commands and data. How it works is easy to understand, but its standard version carries a serious lack of encryption.<\/p>\n\n

      That is why, before entering any credentials, you should check the protocol, limit permissions and protect the account. For most web access today, SFTP or FTPS offer a more reasonable starting point. After that, you can connect that infrastructure with specific business processes \u2014 for example, forms, an API and an email marketing platform \u2014 without asking FTP to do a job it was never designed for.<\/p>\n\n

      Frequently Asked Questions About FTP<\/h2>\n\n

      These brief answers address the questions that usually come up when setting up access or comparing protocols.<\/p>\n\n

      What Does the Acronym FTP Stand For?<\/h3>\n\n

      FTP stands for File Transfer Protocol<\/em>. It defines the rules for uploading, downloading and managing files between systems connected over a TCP\/IP network.<\/p>\n\n

      Which Port Does FTP Use?<\/h3>\n\n

      TCP port 21 is normally used for the control connection. In active mode, the server usually originates the data channel from port 20; in passive mode, another server port is negotiated. The exact port may change if the administrator has customized the configuration.<\/p>\n\n

      Are FTP and SFTP the Same Thing?<\/h3>\n\n

      No. FTP is the traditional protocol and does not encrypt the session by itself. SFTP is a transfer protocol that runs over SSH, encrypts the communication and usually uses port 22. You also should not confuse SFTP with FTPS, which adds TLS to the FTP protocol.<\/p>\n\n

      Can You Use FTP From the Browser?<\/h3>\n\n

      Modern browsers have removed or reduced native support for ‘ftp:\/\/’ addresses. To work with a server, it is best to use a dedicated client, a terminal tool or your hosting’s file manager.<\/p>\n\n

      What Information Do You Need to Connect?<\/h3>\n\n

      You need the hostname or IP address, a username, a password or key, the port and the protocol. You may also need to accept a certificate or verify an SSH fingerprint the first time you connect.<\/p>\n\n

      Is It Advisable to Send Personal Data Over FTP?<\/h3>\n\n

      Not over plain FTP, because it transmits the information unencrypted. If the file contains personal data, credentials or sensitive business information, use an encrypted solution and apply minimum permissions, activity logging and the relevant legal obligations.<\/p>\n\n

      What Is the Difference Between Active and Passive Mode?<\/h3>\n\n

      In both cases the client opens the control channel. In active mode, the server initiates the data connection toward the client; in passive mode, the client opens that second channel as well, toward a port specified by the server. Passive mode usually coexists better with modern firewalls and routers.<\/p>\n\n

      Is FTP Used to Send Email Campaigns?<\/h3>\n\n

      No. FTP moves files between systems, whereas an email marketing platform manages contacts, consent, segmentation, sends, unsubscribes and statistics. You can use SFTP to maintain a website’s resources and Mailrelay to capture subscribers and communicate with them.<\/p>\n\n

      Related entries<\/h2>\n\n