FTP, short for File Transfer Protocol, is a standard protocol that copies computer files from a server to a client, or from a client to a server, over a network. It uses two connections, one for commands and one for file data. FTP sends usernames and passwords as plain text unless it runs over Secure Shell (SSH) or over Transport Layer Security (TLS).
History of FTP
Creator: Abhay Bhushan (RFC 114); later IETF working groups. Year: 1971.
Abhay Bhushan wrote the original File Transfer Protocol specification. It was published as RFC 114 on 16 April 1971. RFC stands for Request for Comments. The Internet Engineering Task Force (IETF) uses this series for network standards. Until 1980 FTP ran on the Network Control Program (NCP). NCP came before TCP/IP on the early Internet.
The protocol moved to TCP/IP with RFC 765 in June 1980. RFC 959 became the current specification in October 1985. Later documents extend it. RFC 1579 added a firewall-friendly passive mode in February 1994. RFC 2228 defined security extensions in October 1997. RFC 2428 added IPv6 support in September 1998.
FTP uses two connections. The control connection carries commands and status codes. The data connection carries the file. In active mode the server opens the data connection from its port 20. In passive mode the client opens it. Passive mode helps when a firewall blocks incoming connections to the client.
FTP sends usernames and passwords as plain text. For that reason it is often secured with SSL/TLS, which is called FTPS. It can also be replaced with the SSH File Transfer Protocol (SFTP), which runs inside an SSH connection.
Changelog and latest update
RFC 959 has been the current FTP specification since October 1985. Later RFCs amend it without replacing it. Passive mode, IPv6 support and security all come from separate documents. RFC 1579, from February 1994, described a firewall-friendly passive mode. A client behind a firewall can use that mode to open the data connection.
RFC 4217 came out in October 2005. It defines how FTP uses Transport Layer Security (TLS). The client asks for TLS with the AUTH TLS command. The server replies with code 234 when it will honour the request.
RFC 2577, FTP Security Considerations, came out in May 1999. It lists security problems in FTP. RFC 2428 from September 1998 adds IPv6 support and a new passive mode. Both changes extend the base protocol without replacing it.
Latest update: RFC 4217, Securing FTP with TLS, 2005-10
The IETF published RFC 4217 in October 2005. The document shows how FTP can use TLS for its control and data connections. Servers that support it let clients ask for encryption before a password is sent. The RFC Editor page lists the status of the document.
Usage examples
FTP commands are short words such as USER, PASS, CWD, STOR and QUIT, and each one is defined in RFC 959. Most people use an FTP client program or the curl command rather than typing commands. The FTP URL form names the server, the path and the file. The four examples show a download, an upload in passive mode, an encrypted FTPS upload and the command sequence of a short session. Replace the placeholder host and password before use.
curl -u jane:PASSWORD \
-o guide.pdf \
ftp://ftp.example.com/guide.pdfThe u option sends the user name and password to the FTP server. The o option saves the file under the local name guide.pdf. The URL names the server and the file path. Curl opens the control connection, then the data connection, and copies the file to disk.
curl --ftp-pasv \
-u jane:PASSWORD \
-T index.html \
ftp://ftp.example.com/public_html/The ftp-pasv option tells curl to open the data connection itself, which works behind a firewall. The T option uploads the local file index.html to the directory at the end of the URL. The trailing slash marks the path as a directory.
curl --ssl-reqd \
-u jane:PASSWORD \
-T index.html \
ftp://ftp.example.com/public_html/The ssl-reqd option requires TLS for the connection, so curl stops if the server does not offer encryption. The user name and password then travel inside the encrypted channel. The remaining options are the same as in the plain FTP upload.
USER jane
PASS ********
CWD public_html
STOR index.html
QUITUSER sends the user name and PASS sends the password. CWD changes the working directory on the server. STOR stores the file that follows in the data connection under its name. QUIT ends the session. Each command is a standard RFC 959 command that the server understands.
References
These sources are outside Websnoogie and were checked on 2026-10-12.
File Transfer Protocol
Wikipedia
The encyclopedia article on FTP. It covers the RFC 114 origin and the active and passive modes. It describes the history of FTP servers. It also covers the secure variants FTPS and SFTP. Its references list each RFC with its status.
RFC 959: File Transfer Protocol
RFC Editor (IETF)
The IETF document from October 1985 that defines the current FTP specification. It lists commands such as USER, PASS, CWD and STOR. It also lists the reply codes and the transfer modes. Clients and servers must support these parts.
RFC 114: File Transfer Protocol
RFC Editor (IETF)
The first FTP specification, published on 16 April 1971 by Abhay Bhushan. The Wikipedia article cites it as the origin of the protocol. It predates the TCP/IP version of FTP, which RFC 765 introduced in June 1980.
RFC 4217: Securing FTP with TLS
RFC Editor (IETF)
The IETF document from October 2005 that defines how FTP uses Transport Layer Security (TLS). It describes the AUTH command for starting TLS. It covers the protection of the data connection. It also sets rules for certificate checks.
RFC 2228: FTP Security Extensions
RFC Editor (IETF)
The IETF document that extends RFC 959 for authentication, integrity and confidentiality. It covers the control and data channels. It introduces optional commands such as AUTH, ADAT and PROT. Each command has its own replies and encodings.
Move site files without losing a single page
A wrong upload can leave a small business site with missing pages. FTP, which stands for File Transfer Protocol, is the older method that copies files from your computer to a server. It works well, but one wrong folder or one old password can overwrite the live site. We handle every upload with care, and we check each folder before a visitor can see the change.
We have worked on websites for more than 20 years. Before we copy any file, we save a full copy of the current site. We compare the file list at both ends, so no image or form file is missed. After the move, we load each page on a desktop and on a phone, and we check that the links point to the new address. A normal-size WordPress site moves free of charge, and larger sites cost $199 once.
Our hosting runs at 99.999% uptime, which is the share of time the server is expected to stay online. For a file check, phone 402-813-4034 any day. Or order the $300 website, which includes up to five pages plus a contact page and is delivered in 3 to 5 days.
