Using FTP Will Get You Hacked: Why Non-Developers Must Know About SFTP Before Connecting to Servers

“I installed FileZilla to upload files to a server, but should I choose FTP or SFTP?”

This is the question you face when uploading AI training datasets to a server or deploying a simple web project. You might choose FTP casually and successfully connect, but wonder if it’s the right choice. The answer is clear: if you chose FTP, you need to switch to SFTP immediately. The FTP SFTP difference isn’t just about features—it’s about security risks.

This guide explains why FTP is dangerous and how SFTP solves these problems through real cases. It covers what to select in FileZilla’s setup screen and security points non-developers often miss.

Real Case: Thousands of Websites Hacked Through FTP Credential Theft

In early 2023, cybersecurity firm Wiz made a shocking discovery. At least 10,000 websites were compromised through stolen FTP credentials. Attackers obtained legitimate FTP account information, used it to inject malicious code into websites, and redirected users to phishing sites.

(Thousands of Websites Hijacked Using Compromised FTP Credentials, SecurityWeek, 2023)

Investigation revealed that websites using various hosting providers and technology stacks were affected, and researchers couldn’t pinpoint exactly how attackers initially obtained the FTP credentials. However, experts suspect they were acquired through network sniffing, phishing, or other data breach incidents.

This case makes one thing clear: FTP is structurally insecure, and once credentials are exposed, attackers can access servers as if they were legitimate users.

Why FTP Is Dangerous: Sending Everything Without Encryption

FTP (File Transfer Protocol) is a file transfer method created in 1971. At that time, the internet was a closed network used only by a small number of researchers, so security wasn’t considered. The problem is that this protocol is still being used in 2025.

(RFC 114: File Transfer Protocol, IETF, April 16, 1971 – Written by Abhay Bhushan at MIT)

The Danger of Plain Text Transmission

FTP sends the following information unencrypted:

• Username and password
• File contents being transferred
• Commands executed on the server

If you upload files via FTP while connected to public Wi-Fi at a cafe, anyone on the same network can see your login information. Even on home Wi-Fi, if your router is compromised or your ISP monitors packets at their level, there’s a risk of exposure.

Real Attack Scenarios

The process for attackers to intercept FTP connections is simpler than you might think:

1. Run packet capture tools like Wireshark or tcpdump
2. Filter FTP traffic on the same network
3. Search for packets containing USER and PASS commands
4. Identify account information transmitted in plain text

Even without extensive technical knowledge, you can follow online tutorials and execute this within 30 minutes.

Risk Factor	FTP	FTPS	SFTP
Password Exposure	Plain text → Anyone can see	TLS/SSL encrypted → Protected	SSH encrypted → Indecipherable even if intercepted
File Content Exposure	Plain text → Can be stolen	TLS/SSL encrypted → Protected	Encrypted transmission → Content protected
Network Sniffing	Completely vulnerable	Secure with encryption	Secure
Public Wi-Fi Use	Very dangerous	Safe	Safe
Ports Used	21 (control), 20 (data)	21 (control), 989-990 (encrypted)	22 (unified)
Firewall Configuration	Complex (multiple ports)	Complex (multiple ports)	Simple (single port)

SFTP vs FTPS: What’s the Difference?

Both SFTP and FTPS were created to address FTP’s security issues, but they take completely different approaches. While both provide encryption, understanding the selection criteria helps you choose the right protocol for your situation.

SFTP: A Completely Different Protocol Based on SSH

SFTP (SSH File Transfer Protocol) has “FTP” in its name, but it’s actually a completely different protocol from FTP. It’s built on the SSH protocol and operates as a separate subsystem for file transfer.

SFTP Advantages:

• Uses single port (22), making firewall configuration simple
• Supports SSH key-based authentication for secure access without passwords
• Standard support in modern cloud platforms and development environments
• Provides advanced file management features like file permissions and symbolic links

SFTP Disadvantages:

• Cannot be used on old systems that don’t support SSH
• Configuration can be complex in some legacy hosting environments

FTPS: FTP with Added TLS/SSL

FTPS (FTP Secure or FTP over TLS/SSL) is a protocol that adds a TLS/SSL encryption layer to existing FTP. It provides encryption in a similar way to HTTPS used by websites.

FTPS Advantages:

• Good compatibility with legacy systems because it’s FTP-based
• Easy to upgrade existing FTP servers
• Useful in environments with established FTP infrastructure like banks and financial institutions
• Allows choice between Explicit and Implicit modes

FTPS Disadvantages:

• Complex firewall configuration due to multiple ports
• Requires distinction between Active/Passive modes
• Uses certificate-based authentication instead of SSH key authentication
• Can have connection issues in NAT environments

Comparison Item	FTP	FTPS	SFTP
Encryption Method	None	TLS/SSL	SSH
Protocol Base	FTP	FTP + TLS/SSL	SSH
Ports Used	21, 20	21, 989-990, others	22
Firewall Friendly	Poor	Poor	Good
Authentication	Password	Password + Certificate	Password + SSH Key
Legacy Compatibility	Best	High	Low
Cloud Support	Almost none	Limited	Standard
Security Level	Very low	High	Very high
Setup Complexity	Simple	Complex	Medium
Recommended Use	❌ Do not use	△ Legacy environments	✅ Most cases

How SFTP Solves the Problem: Protecting Everything with SSH Encryption

SFTP fundamentally solves FTP’s security issues. All data is transmitted encrypted, so even if someone intercepts packets, they cannot read the contents.

Transmission Through Encrypted Tunnels

When an SFTP connection starts, the following process occurs:

1. Client and server establish an SSH connection
2. An encrypted tunnel is created
3. All subsequent data is transmitted through this tunnel

As a result, login information, file contents, and execution commands are all encrypted. This is why using SFTP on public Wi-Fi is safe.

SSH Key Authentication: Safer Than Passwords

SFTP supports authentication using SSH keys in addition to passwords. You create a public-private key pair, register the public key on the server, and keep the private key only on your computer. This method has the following advantages:

• Passwords are not transmitted over the network
• Access is impossible without the key file
• Prevents password guessing attacks (brute force)

This is why many cloud servers and web hosting services recommend SSH key authentication as the default.

FileZilla Setup: Choosing SFTP Instead of FTP

FileZilla is a representative client that supports FTP, FTPS, and SFTP. However, because it’s called an “FTP client,” many people mistakenly believe it can only use FTP. In reality, it supports various security protocols.

Items to Check During Connection Setup

When you open FileZilla’s Site Manager, you can configure the following items:

Protocol Selection

• FTP – File Transfer Protocol (❌ Do not use)
• SFTP – SSH File Transfer Protocol (✅ Top priority choice)
• FTPS – FTP over explicit TLS/SSL (△ Only in legacy environments where SFTP cannot be used)

Port Number

• Selecting SFTP automatically enters port 22
• Selecting FTPS enters port 21 (Explicit mode)
• Change if the server administrator specified a different port

Logon Type

• Normal: Enter username and password
• Key file: Select SSH private key file (SFTP only)

Connection Testing and Troubleshooting

When attempting to connect via SFTP, you may see this message:

“The server’s host key is unknown. You have no guarantee that the server is the computer you think it is.”

This is a security procedure to verify the fingerprint of a server you’re connecting to for the first time. Check if it matches the fingerprint received from your server administrator, then click “OK.” This message won’t appear on subsequent connections.

Connection Failure Cause	Solution
“Connection timed out” (SFTP)	Port 22 may be blocked by firewall. Check with network administrator
“Connection timed out” (FTPS)	Port 21 and data ports may be blocked. Try Passive mode
“Authentication failed”	Username or password error. Check case sensitivity
“No supported authentication methods”	Server doesn’t allow password authentication. SSH key required
“Certificate verification failed” (FTPS)	Server certificate issue. Add exception after verifying trustworthiness

When Should You Choose FTPS?

While SFTP is the best choice in most situations, FTPS may be more appropriate in the following special cases:

Legacy Financial Systems

Banks and financial institutions have built FTP infrastructure over decades. In these environments, many systems don’t support SSH, and upgrading to FTPS is a realistic choice. When encryption is needed for regulatory compliance but completely replacing existing systems is difficult.

Large File Transfer Requirements

Some corporate environments regularly transfer large files ranging from several GB to TB. FTPS maintains FTP’s performance characteristics while providing encryption, so it can be faster than SFTP in certain network environments. (However, the difference is minimal on modern hardware)

Existing FTP Server Upgrades

If you already have an FTP server and installing SSH is difficult, upgrading to FTPS is the quickest security improvement method. You only need to update server software and configure TLS/SSL certificates.

Important: If none of the above situations apply, choosing SFTP is safer and easier to manage.

Are There Really No Cases Where FTP Should Be Used?

In principle, once you understand the FTP SFTP difference, there’s almost no reason to choose FTP. However, you may have no choice but to use FTP in the following extremely limited situations:

Completely Isolated Internal Networks

In closed networks physically separated from the external internet, FTP’s security risks are relatively low. However, even in these cases, considering internal threats (malicious employees, malware introduced via USB), FTPS or SFTP is safer.

Public File Distribution

Anonymous FTP servers are sometimes operated to provide public files anyone can download. However, nowadays, downloads via HTTP/HTTPS are more common and easier to manage.

Conclusion: If none of the above situations apply to you, you must use SFTP unconditionally. If your environment cannot use SFTP, choose FTPS as a second option.

Why SFTP Is Especially Important in AI Learning Environments

When studying AI or machine learning, you often use servers. File transfer is necessary when accessing Jupyter Notebook servers, uploading training datasets, or downloading trained models.

Protecting Sensitive Data

Data used for AI training often contains personal information. Transmitting data like medical images, financial transaction records, or user behavior logs via FTP can create legal issues. GDPR and privacy protection laws require encryption during data transmission.

Preventing Model File Leaks

Trained AI model files (weights, checkpoints) are the result of months of research and computing resources. If intercepted during FTP transmission, there’s a risk of intellectual property infringement or leakage to competitors.

Accessing Cloud GPU Servers

When using GPU instances on cloud platforms like AWS, Google Cloud, or Azure, they typically allow only SFTP access by default. FTP or FTPS ports are blocked for security reasons in most cases. To become familiar with cloud environments, you should develop the habit of using SFTP from the start.

Task Type	Risk When Using FTP	When Using FTPS	Benefits of Using SFTP
Dataset Upload	Possible personal information exposure	Protected with encryption but complex setup	Data protection with encryption + simple setup
Model File Download	Intellectual property leakage risk	Protected with encryption	Safe transmission + SSH key authentication
Jupyter Server Access	Token/password exposure	Encrypted but limited compatibility	Safe with SSH key authentication + cloud standard

What If Port 22 Is Blocked? Alternative Solutions

Corporate or school networks sometimes block SSH port 22 due to security policies. In such cases, you can try the following methods:

Running SSH on Different Ports

If you have server administrator privileges, you can configure SSH service to run on different ports (e.g., 2222, 8022). Since ports 80 (HTTP) and 443 (HTTPS) are typically not blocked, running SSH on these ports is another option.

Using FTPS

If you cannot use SFTP, consider FTPS as a second choice. This is FTP with TLS/SSL encryption added—not as convenient as SFTP but much safer than plain text FTP. Select the “FTPS – FTP over explicit TLS/SSL” option in FileZilla.

FTPS Setup Precautions:

• Check which mode the server supports between Explicit and Implicit modes
• Using Passive mode makes firewall traversal easier
• Verify that the server certificate is valid

Connecting Through VPN

If your company provides VPN, you can use SFTP after VPN connection. VPN itself provides an encrypted tunnel, ensuring security.

Practical Decision Flowchart

A simple decision-making process for choosing the right protocol for your situation:

1. Is SSH (port 22) available?

• Yes → Use SFTP (best choice)
• No → Go to 2

2. Does the legacy system not support SSH?

• Yes → Go to 3
• No → Check if SSH port can be changed to another number → Use SFTP

3. Is there an FTP server that supports TLS/SSL?

• Yes → Use FTPS (second choice)
• No → Go to 4

4. Is it a completely isolated internal network?

• Yes → FTP is possible but recommend introducing FTPS or SFTP
• No → Do not use FTP, server upgrade needed

Conclusion

The FTP SFTP difference isn’t just about technical specifications—it’s the difference between being hackable or not. FTP sends passwords and files in plain text, leaving you completely exposed to network sniffing attacks. In contrast, SFTP protects all data with SSH encryption and provides additional security through SSH key authentication.

FTPS is an intermediate step that can safely upgrade FTP in legacy environments. It provides encryption but has complex firewall configuration and poor compatibility with modern development environments. Choose SFTP when possible, and consider FTPS as a second option only when unavoidable.

When you first use a server while entering AI learning or development, you must choose SFTP when selecting protocols in clients like FileZilla. Unless you have specific reasons, you should not use FTP, and even if hosting providers or server administrators provide FTP information, requesting SFTP access information is safer.

Security cannot be recovered after an incident occurs. Choosing the safe method from the beginning is the most reliable protection.