What Is an FTP Server, and Should You Run One in 2026?

An FTP server is a file transfer service that uses the FTP protocol (ports 21 for control, 20 for data). In 2026, almost no one should run one. SFTP (over SSH) or object storage (S3-compatible) is the right answer for almost every use case.

What FTP actually does
Why not to use FTP
The right alternatives
When FTP is still legitimate
If you must run FTP
SFTP setup
Object storage setup
FAQ

What FTP actually does

FTP transfers files between a client and a server. The protocol has two channels:

Control channel (port 21). Commands and responses.
Data channel (port 20, active mode) or a negotiated port (passive mode). The actual file data.

The protocol dates from 1971, predates TCP/IP, and was designed for the ARPANET. It carries credentials in plaintext, the data is unencrypted, and the active/passive mode choice makes firewall configuration a nightmare.

Why not to use FTP

The five reasons:

Plaintext credentials. The username and password are sent in clear text on port 21. Anyone with a packet sniffer on the network sees them.
Unencrypted data. The file contents are sent in clear text. Anyone with a packet sniffer sees the files.
Firewall unfriendly. Active mode requires inbound connections to a random port; passive mode requires a range of inbound ports. Modern firewalls hate this.
NAT unfriendly. Active mode breaks behind NAT; passive mode requires a static port range.
Modern replacements. SFTP (SSH File Transfer Protocol, port 22) and object storage (S3-compatible, port 443) do the same job with encryption and firewall-friendly ports.

The right alternatives

The three modern alternatives:

SFTP. Built into SSH. Every modern OS has an SFTP client. The team that runs an SSH server already has SFTP. No additional setup.
Object storage (S3-compatible). The right answer for large files, high throughput, and application integration. The team that uses MinIO, AWS S3, or Cloudflare R2 has a modern file transfer system.
rsync over SSH. The right answer for incremental transfers, backups, and directory sync. Built into SSH.

When FTP is still legitimate

Three cases:

Legacy integration. The team has a 20-year-old application that only speaks FTP. The right answer is to migrate, but the migration is a separate project.
Compliance. Some regulatory frameworks (PCI-DSS, HIPAA) explicitly forbid FTP because of the plaintext issue. The team that needs to accept FTP for compliance reasons should isolate it on a separate network and require encryption (FTPS, which is FTP-over-TLS).
Anonymous public file servers. The team that hosts a public file mirror (Linux ISO distributions, public datasets) can still use FTP because the data is public anyway. Most public mirrors have moved to HTTPS.

If you must run FTP

The right configuration:

Use FTPS, not FTP. FTPS is FTP-over-TLS; the credentials and data are encrypted.
Require explicit TLS. AUTH TLS or AUTH SSL should be required; the connection should fail if TLS is not negotiated.
Restrict users. No anonymous access (unless that’s the use case). Strong passwords or key-based auth.
Isolate the network. The FTP server should not be on the same network as the production database.
Monitor and audit. Log every login, every file transfer, every failed attempt.

SFTP setup

The right way to set up SFTP:

SFTP is built into SSH. If the team runs an SSH server, they have SFTP.

Configuration:

# /etc/ssh/sshd_config
Subsystem sftp /usr/lib/openssh/sftp-server

Then sudo systemctl reload sshd. SFTP is now available on port 22.

The team that wants to restrict SFTP access to specific users adds a Match block:

Match Group sftpusers
    ChrootDirectory /home/%u
    ForceCommand internal-sftp
    AllowTcpForwarding no
    X11Forwarding no

Now SFTP users are chrooted to their home directories and can’t run shell commands.

Object storage setup

The right way to set up S3-compatible object storage:

Self-hosted MinIO. Run MinIO on a server with enough disk. Provides an S3-compatible API. The team that wants control uses this.
Cloud-managed S3. AWS S3, Cloudflare R2, Backblaze B2, DigitalOcean Spaces. The team that wants simplicity uses this.

For a team migrating from FTP, the easiest path: use the aws s3 sync command or the rclone tool to copy files between the FTP server and an S3 bucket, then deprecate the FTP server.

S3-compatible object storage has these advantages over FTP:

Encryption at rest and in transit.
Firewall-friendly (port 443 only).
Programmatic access (SDK in every language).
Fine-grained access control.
Built-in versioning and lifecycle policies.

The team that switches from FTP to S3 has a more secure, more reliable, more programmable file transfer system.

FAQ

Is FTP still used in 2026?

Yes, mostly for legacy systems. New deployments should use SFTP, object storage, or rsync.

What’s the difference between FTP and SFTP?

FTP is the original protocol (ports 21, 20, plaintext). SFTP is a different protocol (port 22, encrypted) that runs over SSH and is unrelated to FTP despite the name.

What’s the difference between FTP and FTPS?

FTP is the original plaintext protocol. FTPS is FTP-over-TLS, which encrypts the channel. FTPS still uses ports 21/20 and the same protocol; just with TLS.

Should I use FTP for my website’s file uploads?

No. Use SFTP (built into SSH) or an object storage API (S3-compatible). The team that uses FTP for website uploads is the team that has plaintext credentials on the network.

Is FTP ever acceptable in 2026?

Only for anonymous public mirrors (Linux ISO distributions, public datasets) where the data is public anyway. For everything else, use SFTP or S3.

Can I migrate from FTP to SFTP without changing clients?

Some FTP clients support SFTP (FileZilla, WinSCP). The team that uses these can switch the server from FTP to SFTP without changing the client.

What’s the best S3-compatible storage for self-hosting?

MinIO is the standard. The team that wants a managed solution uses AWS S3, Cloudflare R2, or Backblaze B2.

If you are sizing the infrastructure for the kind of project this post covers, the RunxBuild hosting calculator is the right place to model the line items. The compute, the memory, the storage, the bandwidth, the database - each one is a separate number, and the team’s mental model for the platform is the sum of those numbers. The RunxBuild dashboard is where the team sees the actual usage in one place.

Useful related references: