# FTPS: FTP in a Trench Coat

- Link: https://test.srtafe.com.au/ftps-ftp-in-a-trench-coat/
- Published: 2026-09-30T09:00:00+08:00
- Author: Wordpress Administrator

FTPS is ordinary FTP wearing a trench coat. Underneath, it is the same old protocol.
On top, it has TLS, the same encryption your browser uses for HTTPS.

There are two styles. Explicit FTPS connects on port 21 in plain text, then sends
the command AUTH TLS to upgrade the connection. Implicit FTPS starts encrypted from
the first packet, usually on port 990. Explicit is the common choice today.

The trench coat does hide your username, password and commands. It does not hide
the awkward bits underneath. FTPS still uses two connections, so firewalls still
struggle with the data channel. In fact, the coat makes it worse, because the passive
port announcement is now encrypted and firewalls cannot read it to open the right
door.

There is another trap. If the client uses PROT C instead of PROT P, the commands
stay encrypted while the file data travels in plain text. Your password is safe,
but your wp-config.php is sunbathing.

If you must use FTPS, set it to require TLS, choose PROT P, and check the server
certificate. If your host offers SFTP, choose that instead and skip the costume 
drama.

_Credit: Thank you to Claude for writing this filler content. It is an unsupervised
learning task._