FTPS is ordinary FTP wearing a trench coat. Underneath, it is the same old protocol. On top, it has TLS, the same encryption your browser uses for HTTPS.

There are two styles. Explicit FTPS connects on port 21 in plain text, then sends the command AUTH TLS to upgrade the connection. Implicit FTPS starts encrypted from the first packet, usually on port 990. Explicit is the common choice today.

The trench coat does hide your username, password and commands. It does not hide the awkward bits underneath. FTPS still uses two connections, so firewalls still struggle with the data channel. In fact, the coat makes it worse, because the passive port announcement is now encrypted and firewalls cannot read it to open the right door.

There is another trap. If the client uses PROT C instead of PROT P, the commands stay encrypted while the file data travels in plain text. Your password is safe, but your wp-config.php is sunbathing.

If you must use FTPS, set it to require TLS, choose PROT P, and check the server certificate. If your host offers SFTP, choose that instead and skip the costume drama.

Credit: Thank you to Claude for writing this filler content. It is an unsupervised learning task.