FTP, FTPS, and SFTP setup

Create one FileZilla site per protocol. The host name can be the same. The protocol, the port, and the encryption mode cannot be guessed from each other.

Collect the facts before you connect

Ask the server operator for five values: protocol, hostname, port, username, and authentication method. Optional, and useful when a login works but the file list does not: the initial remote directory, the passive port range, and the hostname on the TLS certificate. If any of the five is missing, a successful-looking profile is still a guess. The troubleshooting center is what you use after a profile that was complete still fails.

Open Site Manager

Use File → Site Manager. The General tab holds the protocol, host, port, encryption, and logon. Enter the host as a name or an IP only. A scheme such as ftp:// and a path such as /public_html do not belong in that field. Put a remote folder, if you truly need one, in the Advanced tab as Default remote directory, with a leading slash.

The quick-connect bar is a one-off. It is easy to leave on the previous protocol. Save a site once the values are known.

Explicit FTPS

This is the FTPS mode to prefer when a host offers FTP with TLS. The control connection starts in the clear only long enough to request TLS, then the login runs inside TLS.

Protocol
FTP
Host
The published hostname, ideally the name on the certificate
Port
21, unless the operator published a different explicit port
Encryption
Require explicit FTP over TLS
Logon type
Normal, or Ask for password

“Use explicit FTP over TLS if available” can fall back to plain FTP when TLS is missing. Require explicit TLS so a downgrade does not happen silently. On the first connection, FileZilla shows the certificate. Check it using the steps in secure file transfers before you continue. A warning is not a step to click through.

Implicit FTPS

Implicit FTPS starts TLS immediately. Use it only when the operator says the service is implicit, almost always on port 990. Do not point this encryption mode at port 21.

Protocol
FTP
Port
990, or the implicit port you were given
Encryption
Require implicit FTP over TLS
Logon type
Normal, or Ask for password

If implicit TLS is refused or times out, do not keep the mode and try random ports. Ask whether explicit FTPS on 21 or SFTP on 22 is the service they actually run.

SFTP with a password

SFTP is the SSH file transfer protocol. It does not use the FTP encryption dropdown, the AUTH TLS command, or an FTP data port.

Protocol
SFTP
Port
22, or the published SSH port
Logon type
Normal, or Ask for password
User
The SSH username, which may differ from the FTP username

The first connection shows an SSH host key, not a TLS certificate. Verify that fingerprint before you trust the server. Details are on the security page. A host that only gave you an FTP account will not answer on the SSH port, and the failure belongs in connection errors, not in a password change.

SFTP with a key

Protocol
SFTP
Port
The SSH port
Logon type
Key file
Key file
The private key, .ppk or OpenSSH PEM, never the .pub file

Generate the key with OpenSSH or PuTTYgen. FileZilla does not create the key pair for you. Install only the public key on the server, in the form that server expects. You can also add the private key under Edit → Settings → Connection → SFTP and then use an interactive logon. If the key file has a passphrase, FileZilla asks for that passphrase. It stays on your computer.

More login failures, including “publickey” as the only offered method, are in authentication issues.

Plain FTP

Protocol
FTP
Port
21, unless documented otherwise
Encryption
Only use plain FTP (insecure)
Logon type
Normal, Ask for password, or Anonymous if the server is public

Choose this only when the operator provides no FTPS and no SFTP, and only on a network where exposing the password is acceptable to you. A public network is not that network. Plain FTP is not a troubleshooting step for a host that already supports TLS. If the server answers AUTH TLS with a refusal, ask for SFTP or for real FTPS rather than deciding the warning is optional.

Transfer and advanced fields worth setting

On the Transfer Settings tab, leave the mode on Default or Passive. Set a limit on simultaneous connections if the operator allows only one or two. A 421 during login is the signal that the limit is real.

On the Advanced tab, set a default remote directory only when you know the path from the FTP or SFTP root. A wrong path produces a listing or 550 error after a good login, which is covered in directory listing problems. Leave Server type on Default unless the host named a specific type. The Charset tab can stay on Autodetect unless filenames are the only thing that looks wrong.

FileZilla’s network configuration wizard, in the Edit menu, walks through active and passive behavior on your own computer. It does not configure the remote passive range.

Test the new site

  1. Connect from Site Manager and watch the message log, not only the status bar.
  2. Stop at a certificate or host-key dialog until the fingerprint matches what the operator published.
  3. Treat a 220 or an SSH banner as a successful socket. Treat 230 or a completed SSH login as a successful account check.
  4. Treat a completed directory listing as the end of setup. If it fails, do not rebuild the password. Open the listing guide with the 227 line or the SFTP path error.

Common mistakes

  • One site switched back and forth between SFTP and FTPS until neither profile remains.
  • Encryption left on “if available,” so a TLS outage silently becomes plain FTP.
  • Implicit TLS selected on port 21, or SFTP selected on port 21.
  • The public key selected in the key-file field.
  • A default remote directory copied from a web tutorial that does not match this account.