FTP security
FTPS is not SFTP
Distinguish FTP over TLS from the SSH File Transfer Protocol and choose configuration vocabulary precisely.
People say “secure FTP” and mean two different protocols. FTPS is FTP with TLS. SFTP is file transfer over SSH. They are not interchangeable, and mixing them up wastes an afternoon.
I have watched someone paste FTPS settings into an SFTP profile for an hour before anyone noticed the host key field was empty. The names sound alike. The wire format is nothing alike.
FileZilla, WinSCP, and Cyberduck all support both, but the saved site forms use different fields. Read the labels before you save. Host key is SFTP. Certificate is FTPS. Mixing them up wastes an hour every time.
FTPS keeps separate control and data connections, then encrypts them. SFTP runs over one SSH connection on port 22 and never sends PASV or PORT.
When a hosting panel asks for SFTP, it wants SSH keys or an SSH password, not AUTH TLS on port 21.
Compare the shapes:
FTPS: TLS on port 21 + separate TLS data connections
SFTP: one SSH session, sftp subsystem inside itConnect with the right tool:
# FTPS (explicit TLS on port 21)
curl --ssl-reqd ftp://files.partner.test/report.csv -o report.csv
# SFTP (SSH)
sftp [email protected]On SFTP you might see:
$ sftp [email protected]
[email protected]'s password:
sftp> get report.csv
Fetching /home/alice/report.csv to report.csvFTPS checks a TLS certificate. SFTP checks an SSH host key. Skipping either check means you might talk to the wrong machine.
PASV, EPSV, and PROT P belong to FTPS. Host keys belong to SFTP. Port 22 often means SSH. Port 990 often means implicit FTPS. The port alone does not prove the protocol.
When someone emails you “use secure FTP,” ask which one before you paste settings into FileZilla. One wrong checkbox costs an afternoon.
Open your saved site profile and label every field as FTPS or SFTP. Delete anything copied from the wrong protocol.
Lesson completed