Plain FTP sends usernames, passwords and files in the clear unless something encrypts the connection. FTPS is that something: ordinary FTP wrapped in TLS. Servers that are still reachable from the internet without it are common, and we looked at the scale in Nearly 6 million FTP servers still exposed.
If you run FileZilla Server or FileZilla Pro Enterprise Server (FZPES), your starting position is better than you might expect. The FileZilla Server product line has been through two independent penetration tests by Subgraph, supported by the Open Technology Fund: the first in 2022, and a second, announced in May 2025, after a substantial amount of new code had been added across the suite (the full audit summary is published by the Open Technology Fund). We have since shipped a more robust version, with pre-sets designed to help administrators keep their servers safe. The FTP listener, for example, is configured out of the box to listen on port 21 on all IPv4 and IPv6 addresses and to require explicit FTP over TLS, and a self-signed certificate is generated at installation time.
A good starting position still isn’t a finished setup. For most servers, “setting up FTPS” comes down to four checks: whether plain FTP is still allowed, whether your certificate is one clients can trust, whether the minimum TLS version is sensible, and whether passive-mode data connections get through your firewall. This guide covers them in that order. For the background on how FTPS works and how it differs from SFTP, see What Is FTPS?
1. Check what your FTP listener allows
Open the FTP settings (Protocol settings › FTP and FTP over TLS (FTPS)) and look at the Connection tab. Each listener has an IP address, a port and a protocol setting. On a default installation the protocol reads “Require explicit FTP over TLS”, which means clients must upgrade the connection to TLS before they can log in. If someone has changed it to “Explicit FTP over TLS and insecure plain FTP”, the server will also accept unencrypted connections. Our guide to setting up FTP listeners and connection security explains how to add, edit and remove listeners.
2. Use a certificate your clients can trust
The self-signed certificate created at installation is fine for testing, but it isn’t trusted by default, so clients will show a warning and users have to accept it manually or add a trusted root CA. For anything partners or customers connect to, install a trusted certificate. On the Connection security tab you have three options:
- Provide a certificate. Upload one you already own, enter it manually, or use one already on the server. See How to Integrate X.509 Certificates and Private Keys.
- Use Let’s Encrypt. A free, trusted certificate authority. Configure the Let’s Encrypt options first, then generate the certificate. You must enter the hostnames it should cover, so use the name your clients actually connect to. Renewal is automatic by default.
- Generate a self-signed certificate. Quick, but untrusted, as noted above. See How to Generate a New Self-Signed Certificate.
Click Apply or OK for a newly chosen certificate to take effect. If you ever see the warning “The TLS certificates of the following protocols have expired”, the certificate needs reissuing; this FAQ explains how. If you turn off automatic renewal, put the expiry date in a calendar.
3. Set a sensible minimum TLS version
The same Connection security tab lets you set the minimum TLS version the server will accept. TLS 1.0 and 1.1 have been formally deprecated (RFC 8996), so choose the highest minimum your clients can support. After changing it, keep an eye on your logs for connections from older clients that now fail; our guide to what to look for in your FileZilla Server logs shows what to watch.
4. Make sure passive-mode data connections get through
FTP and FTPS use two channels: one for commands and one for the data itself. In passive mode, the client opens the data channel to an address and port the server provides. By default, FileZilla Server lets the operating system choose that port. On the Passive mode tab you can tick “Use custom port range” to limit it to a fixed range, which makes it practical to open exactly those ports in your firewall, alongside port 21. Our passive mode guide has the details. The usual symptom of a blocked data channel is that login succeeds but directory listings and transfers hang.
5. Test, then switch off plain FTP
Test from a client before you tell anyone else. In FileZilla Pro, for example, set the site’s encryption to “Require explicit FTP over TLS”, connect, review the certificate, then list a directory and transfer a small file. The listing and the transfer are what prove the data channel works, not just the login. If a client reports that the server doesn’t support FTP over TLS, this FAQ covers it.
If plain FTP was enabled on your listener, give the people and systems that use it notice, then set the listener back to “Require explicit FTP over TLS” and confirm that a plain connection is refused. Legacy clients and scripts that never used TLS are the ones most likely to break, so watch your logs for a few days afterward.
Where FileZilla Pro fits in
FTPS is available in both the free FileZilla Server and FZPES. FZPES adds SFTP alongside FTP and FTPS, Active Directory/LDAP integration, role-based access and priority support, for teams that need them.
Running a file transfer server for your team?
FileZilla Pro Enterprise Server adds SFTP alongside FTP and FTPS, plus Active Directory integration and Second Factor Authentication, with no limit on the number of users.