File Transfer Protocol
The File Transfer Protocol – FTP for short – is one of the oldest network protocols on the internet. Its origins go back to 1971. It is used to transfer files between a client (such as your own computer) and a server, for example to upload a website's files to the web server. FTP works on the client-server principle over TCP/IP. A major drawback: classic FTP transmits data and even login credentials unencrypted. From an IT security perspective, it should therefore be replaced today by encrypted variants such as SFTP or FTPS.
Data transfer – uploading and downloading – takes place via an FTP account with username and password. FTP used to be usable directly in the web browser; however, major browsers such as Chrome and Firefox removed support in 2021 for security reasons. Today, dedicated programs or the command line are used instead.
For anyone who prefers a graphical interface, there are FTP programs such as FileZilla, WinSCP or Cyberduck. They show local and remote files side by side, much like a file explorer, so files can be transferred by drag and drop. Most of these programs also support the secure variants SFTP and FTPS.
How the File Transfer Protocol works technically
For a transfer, the FTP client first establishes a TCP connection to the server, the so-called control channel, by default via port 21. Commands are exchanged over this channel. A second connection is opened for the actual data: in active mode, the server establishes it from port 20 to the client; in the passive mode common today, the client connects to a port specified by the server. Passive mode works better with firewalls and routers.
At the start, the user logs in to the FTP server with username and password. They can then download, upload, rename or delete files and create, change and remove directories. A separate data connection is established for each file transfer; error control is handled by the underlying TCP protocol.
Development and use of FTP today
FTP was developed in the early days of the internet, at the time of ARPANET, the forerunner of today's internet. It was intended to make exchanging documents and data between computers as simple as possible. Security hardly played a role back then, as the network connected only a few trusted institutions.
Today, classic FTP is in retreat. For uploading website files, exchanging data with partners or automated transfers – such as product data to marketplaces or price comparison portals – encrypted methods are mostly used: SFTP (SSH File Transfer Protocol) transfers files over an encrypted SSH connection, while FTPS adds TLS encryption to FTP. Many hosting providers no longer offer unencrypted FTP access at all. In shops and websites, code is also increasingly rolled out via version control (e.g. Git) and automated deployments rather than by file upload.
A special feature of FTP is anonymous access: public FTP servers used to allow login without an account of your own, for example to download software or documents. Anonymous users were generally not allowed to change or upload anything. This use, too, has now largely been replaced by HTTPS downloads.
Tip for shop owners: check whether old FTP accounts still exist on your server and replace them with SFTP using strong passwords or keys. Accounts that are no longer needed – for example those of former service providers – should be deleted.