FileZilla connection errors

A refused or timed-out connection fails before FileZilla can test a password. Read the first status line, then match the protocol to the port.

Where the session stops

FileZilla reports several different failures under a short status such as “Could not connect to server.” The message log distinguishes them. Connection errors in this guide are the ones that happen before a usable greeting: no FTP 220 line, and no SSH banner.

If the log already shows 220 or SSH-2.0 and then rejects the login, move to authentication issues. If it shows 230 Login successful and then fails while listing files, move to directory listing problems. Changing the password cannot repair a socket that never opened.

Connection refused

ECONNREFUSED means the computer at that address responded, and the chosen port refused the connection, or a firewall rejected it outright. Nothing is listening, the service is bound to another port, or your address is being rejected before the application speaks.

Status: Connecting to 203.0.113.10:21...
Status: Connection attempt failed with "ECONNREFUSED - Connection refused by server".
Error: Could not connect to server

Example only. 203.0.113.10 is a documentation address, not a server operated by Filenilla.

Check three facts in File → Site Manager. The host is a hostname or an IP, with no ftp:// prefix and no folder. The protocol matches the service you were given. The port is the one that service actually uses: 21 for FTP and for explicit FTPS, 990 only for implicit FTPS, and 22 for SFTP unless the operator published another SSH port.

A refusal does not show a certificate dialog and does not show a password prompt. Ask the operator whether the daemon is running and whether earlier failed logins caused the address to be blocked. Retrying the same port every few seconds can keep a block in place.

Connection timed out

ETIMEDOUT means FileZilla did not finish a TCP handshake before the limit in Edit → Settings → Connection. Packets were dropped, the name points at an address that never answers, or a filter is discarding the traffic. This is a different fault from a refusal, which at least got a reject.

Status: Resolving address of files.example.com
Status: Connecting to 203.0.113.10:22...
Status: Connection attempt failed with "ETIMEDOUT - Connection attempt timed out".

Write down the IP in that line and compare it with the address your operator published. A stale DNS name is a common reason the right label reaches the wrong machine. Raising the timeout only waits longer. It does not open a filtered port. Use a longer wait only when you are separating a slow link from a black hole, and put the setting back when the test is done.

A timeout that appears after 230, with the words “Connection timed out after 20 seconds of inactivity,” is not this problem. The control connection worked, and the data connection did not. Follow the listing guide.

Connection reset or closed

ECONNRESET and “Connection closed by server” mean a socket opened and then died. On the first attempt, the remote service may have crashed, a middlebox may have reset an unexpected protocol, or a security policy may have cut the session. During a transfer, the same wording can be an idle firewall, a disk quota, or a server limit. Read whether the reset is before the greeting or after files have started to move. Those are different repairs.

If the reset happens only when TLS starts, treat it as an encryption mismatch and use secure file transfers. Do not clear it by selecting plain FTP.

The port belongs to a different service

FTP, FTPS, and SFTP are not interchangeable names for one socket. FileZilla can reach a live port and still fail immediately because the bytes are wrong.

  • SFTP pointed at port 21 often dies at the SSH handshake, because an FTP server is not an SSH server. The reverse, FTP pointed at port 22, fails when the banner starts with SSH-2.0.
  • Implicit FTPS expects TLS before any banner and is usually published on port 990. Pointed at port 21, it can report a GnuTLS error such as “An unexpected TLS packet was received,” because the server first speaks plain FTP.
  • Explicit FTPS on port 21 speaks FTP first, then sends AUTH TLS. That is the mode to use when the host says “FTP over TLS” or “explicit FTPS” without mentioning 990.

The setup page lists a clean profile for each of these. Keep them as separate sites so a working FTPS profile is not overwritten by an SFTP experiment.

The server accepted you, then stopped the session

421 is not a refused port. The service answered and then refused another session, often because the account already has its maximum number of connections or the address made too many attempts. In Site Manager, open Transfer Settings and limit simultaneous connections, sometimes to 1, then wait before trying again. Hammering Connect extends the same limit.

425 and 426 belong to the data connection or to a transfer that already started. They are covered with directory listings and transfers, not with the initial handshake.

A practical sequence

  1. Copy the first failed status line and the host, protocol, and port from Site Manager.
  2. If the line is ECONNREFUSED or ETIMEDOUT, stop changing the password and the key.
  3. Match the protocol to the documented port. Create a second site if you need to test another protocol.
  4. Confirm the resolved IP with the operator if the name is theirs and the address looks unfamiliar.
  5. Ask whether the service is running and whether your address is allowed. Take the status line with you.
  6. Only after a greeting appears should you move on to authentication or, if TLS fails first, to the certificate check.

How to tell it is fixed

The connection stage is fixed when the log gets past the socket. For FTP and explicit FTPS, that is a 220 greeting. For implicit FTPS, the TLS handshake completes and a greeting follows. For SFTP, an SSH-2.0 banner appears. A later 530 or host-key prompt is progress: the connection error is gone, and a different guide applies.

Common mistakes

  • Putting a full URL or a folder path in the host field.
  • Using the SFTP protocol on the FTP port, or explicit TLS on an implicit-only port.
  • Treating a timeout as a bad password and locking the account with retries.
  • Raising the timeout and calling the filter fixed.
  • Turning off TLS because a TLS port never answered. The socket failure is earlier than the certificate.