Is it safe to have FTP port 21 open to the internet?

Plain FTP is not safe on the internet. It sends usernames, passwords and files unencrypted, so anyone on the network path can read them, and FTP servers are constantly hit by password-guessing bots. Replace it with SFTP, or require FTPS (FTP over TLS) and restrict who can connect.

What is the difference between FTP, FTPS and SFTP?

FTP is unencrypted. FTPS is FTP with TLS encryption added, usually still on port 21 or on port 990. SFTP is a different protocol that runs over SSH, usually on port 22, and encrypts everything. SFTP is the simplest secure choice.

How do I check if anonymous FTP login is allowed?

Run nmap -p 21 --script ftp-anon your-server from outside your network. If it reports 'Anonymous FTP login allowed', anyone can log in without a password.

High risk Port 21 · FTP file transfer

FTP port 21 is open: what it means and how to fix it

By Stephane Meus, CEH, PenTest+ · Updated 11 October 2026 · 6 minute read

Short answer: port 21 is FTP, an old way of uploading and downloading files. Plain FTP sends usernames, passwords and files without encryption, so they can be read on the way, and bots constantly try to guess FTP passwords.

The fix: turn FTP off if nobody uses it. If you need file transfer, switch to SFTP. If you must keep FTP, require encryption (FTPS), turn off anonymous login, and allow only known IP addresses.

What is port 21?

Port 21 is where an FTP (File Transfer Protocol) server listens for logins. FTP dates from the 1970s, before encryption was normal on networks. It's still common on small business networks because many devices and older tools turn it on by default.

Where it usually comes from:

Network storage (NAS) such as Synology or QNAP, with the FTP service turned on and a router rule forwarding port 21.
Printers and scanners set up to "scan to FTP".
Web hosting, where FTP was the original way to upload website files.
Windows servers running the IIS FTP service or FileZilla Server for sharing files with customers or suppliers.
Routers and firewalls with a built-in FTP feature for USB drives.

Why an open port 21 is high risk

Passwords travel in plain text. Anyone who can see the traffic, such as on public Wi-Fi or a compromised network along the way, can read the username, password and files.
Password guessing never stops. FTP servers on the internet get automated login attempts all day. FTP accounts often reuse a Windows or email password, so one guess can open more than files.
Anonymous login is often left on. Some servers let anyone log in as "anonymous" with no password, which can expose or let strangers upload files.
FTP server software has had serious flaws. For example, a tampered vsftpd 2.3.4 download contained a backdoor (CVE-2011-2523), and ProFTPD's mod_copy let attackers copy files without logging in (CVE-2015-3306).

How it looks in your report your-office-ip

21 FTP Unencrypted, often misconfigured for anonymous access High

Any High finding caps your exposure grade at D

How to confirm it and find the device

Check from outside your network. A free FreshScanSentry Basic Scan of your public IP address or domain shows whether port 21 answers, and which FTP software is behind it.
Or use Nmap from another connection, such as a phone hotspot:
```
nmap -p 21 -sV --script ftp-anon,ftp-syst your-public-ip
```
The service line names the FTP software and version. Anonymous FTP login allowed means anyone can log in without a password.
Check whether it supports encryption:
```
openssl s_client -connect your-public-ip:21 -starttls ftp
```
If this shows a certificate, the server supports FTPS. That only helps if the server also requires it.
Find which device it points to. In your router or firewall, look for a port forwarding (NAT) rule for port 21 and note the inside IP address. On web hosting, it's the hosting account's FTP service.

Only scan addresses you own or have written permission to test.

How to fix it

1. If nobody uses FTP: turn it off

Delete the port 21 forwarding rule on your router or firewall.
Turn off the FTP service on the device. On a NAS it's usually under File Services. On Windows, stop and disable the FTP service in IIS or FileZilla Server.
On a printer or scanner, switch "scan to FTP" to scan to email or to a network folder (SMB) that isn't exposed to the internet.

2. If you need file transfer: switch to SFTP

SFTP runs over SSH and encrypts everything, including the login. Most file transfer apps (FileZilla, WinSCP, Cyberduck) support it, and most NAS devices and Linux servers can turn it on with a checkbox. Share SFTP access instead, then close port 21.

If you open SSH for SFTP, follow the same rules as any SSH service: use strong passwords or keys, and limit it to known IP addresses where you can. See our guide to outdated OpenSSH for keeping it updated.

3. If you must keep FTP: lock it down

Require FTPS (FTP over TLS) and reject unencrypted logins. In FileZilla Server and IIS this is a "require TLS" or "require SSL" setting. In vsftpd it's ssl_enable=YES plus force_local_logins_ssl=YES and force_local_data_ssl=YES.
Turn off anonymous login (vsftpd: anonymous_enable=NO).
Allow only known IP addresses, such as your partners' offices, in the firewall rule.
Keep each user in their own folder (vsftpd: chroot_local_user=YES) and give FTP accounts their own passwords, not their Windows or email ones.
Update the FTP server software or the device firmware.

FreshScanSentry flags any open port 21 as High, because from outside it can't see whether every login is forced to use encryption. If you've required FTPS and limited access to known IPs, you've handled the risk even though the port still shows as open.

4. Re-scan to confirm

Run another external scan after the change. If you turned FTP off or moved to SFTP, port 21 should no longer appear, and your exposure grade should go up.

Common questions

Isn't FTP fine if the password is strong?

A strong password helps against guessing, but plain FTP still sends it unencrypted every time someone logs in. Anyone watching the traffic can copy it.

Our website host only offers FTP.

Most hosts now offer SFTP or FTPS. Check the hosting control panel or ask support. If they genuinely don't, that's a sign to consider a different host.

A supplier needs to send us files by FTP.

Ask if they can use SFTP. If not, run FTPS with a dedicated account for that supplier, allow only their IP address, and keep their folder separate from everything else.

Sources: RFC 959 (FTP) · RFC 4217 (FTP over TLS) · NVD: CVE-2011-2523 · NVD: CVE-2015-3306 · Nmap ftp-anon