Which is more secure, SFTP or FTPS?

Both encrypt your connection, so neither leaves data readable in transit. SFTP tends to be the simpler choice in practice because it uses a single SSH connection for both commands and data, avoiding the active/passive mode and firewall issues that can affect FTP and FTPS, which still use two separate connections even when encrypted.

Should I ever use plain FTP instead of FTPS or SFTP?

Only if the server genuinely doesn't support anything else, and even then it's worth asking your host to enable FTPS or SFTP. Plain FTP sends your username, password, and file contents unencrypted, so anyone on the network path between you and the server can read them.

FileZilla Supported Protocols: FTP, FTPS & SFTP

FileZilla supports a number of protocols to allow you the greatest possible flexibility in transferring files.
It supports:

FTP
FTPS
SFTP

What Each Protocol Actually Does

All three protocols move files between your computer and a server, but they’re not just “the same thing with different security levels” — the underlying mechanics differ enough that it affects how reliably they work through firewalls, not just how secure they are.

FTP sends everything — including your username and password — as plain text over port 21. Anyone positioned between you and the server on the network path can read it. It also opens a separate connection for the actual file data, apart from the connection used for commands.
FTPS is the same FTP protocol and the same two-connection design, wrapped in TLS encryption. It typically uses port 21 (explicit FTPS, negotiated after connecting) or port 990 (implicit FTPS, encrypted from the start). The commands and file data are unreadable in transit, but FTPS inherits FTP’s separate control/data connection behavior.
SFTP isn’t FTP at all — it’s a completely different protocol that runs over SSH, normally on port 22. Commands and data travel over a single connection, and encryption is part of SSH itself rather than a layer added on top.

Firewall and NAT: Why SFTP Is Often Easier

FTP and FTPS negotiate a second connection for data transfer, separate from the one used for commands — which side opens that second connection depends on active or passive mode, and firewalls or NAT routers frequently block whichever side isn’t expected. See FTP Active vs Passive Mode for how that negotiation works and how to fix it when it doesn’t.

SFTP sidesteps this entirely: one SSH connection carries both commands and file data, so there’s no second connection to negotiate or block. That’s a practical reason SFTP tends to “just work” behind firewalls where FTP and FTPS sometimes need active/passive mode adjustments first.

Which One Should You Actually Use?

Your server offers SSH access: use SFTP. It’s encrypted by design, generally easier to get working through a firewall, and doesn’t require choosing between active and passive mode.
You’re stuck with an FTP-only server (common on older shared hosting) but need encryption: use FTPS. It works with infrastructure that already speaks FTP, just wrapped in TLS.
Avoid plain FTP whenever you have a choice. Credentials and file contents travel unencrypted; anything sent over it can be read by anyone on the network path.

FileZilla connects using all three from the same Site Manager, so picking the right protocol for each server doesn’t mean switching tools — just the protocol dropdown when you set up the connection.

Comparison Table

Protocol	Encrypted	Base Protocol
FTP	No¹	FTP
FTPS	Yes – TLS	FTP
SFTP	Yes	SSH

By default, FileZilla attempts to use FTPS for FTP connections, and will display a warning if the remote server doesn’t support encrypted connections.

To learn more about FileZilla Pro Supported Protocols see https://filezillapro.com/docs/v3/features-v3/filezilla-pro-supported-protocols

Tags: FileZilla Pro Supported Protocols, FTP, FTPS, protocols, SFTP