Connection Settings
An FTP client needs a hostname, an authentication method, and a compatible connection profile. The profile combines the FTPS security mode, command port, and data-connection mode. Configure these together: a reachable command port can permit login while a separate blocked data connection prevents uploads and downloads.
Connection Profile
Use Explicit FTPS with Passive mode unless the connecting system requires another supported profile. Alternate command ports help when a corporate network blocks the standard port.
| Connection Type | Command Port | Alternate Port | Use |
|---|---|---|---|
| Explicit FTPS (FTPeS) | 21 | 3021 | Recommended default; negotiates TLS after connecting |
| Implicit FTPS | 990 | 3990 | For clients that require TLS from the start of the connection |
| Plain FTP | 21 | 3021 | Disabled by default; enable only for clients that cannot use encryption |
For Passive mode, the client must also reach Files.com data ports 40000–50000. Active mode instead requires a return connection from Files.com to the client. The data-connection settings apply to all three profiles.
Hostname
Use [your_subdomain].files.com or your site's configured Custom Domain. The hostname must match the TLS certificate presented for FTPS. Both Implicit and Explicit FTPS use the certificate configured for the site's web address.
Use hostnames rather than hardcoded IP addresses so DNS can direct clients to available servers and follow regional routing. A firewall can allow fixed addresses while the client continues resolving a hostname. Firewall Configuration distinguishes these network rules from client connection settings.
For an unknown-certificate prompt or hostname mismatch, use certificate troubleshooting.
Credentials
FTP and FTPS require authenticated access; anonymous FTP is not supported. For a password login, supply the user's username and the password supported by their authentication method. An account set to None has no password authentication. Browser-based SSO also does not supply an FTP password; Active Directory and LDAP are the SSO providers that support direct password authentication over FTP.
An API key can serve as the FTP password. The login name is @api- followed by the key's ID or name, such as @api-5373469 or @api-botsync, and the password is the API key itself. This identifies the key rather than using its owner's username. Use this authentication for unattended transfers. SSH keys authenticate SFTP connections and cannot authenticate FTP or FTPS.
The account must have FTP protocol access, whether granted directly or through the applicable group settings. Its folder permissions determine which file operations it can perform after login. For password sign-in, complete any required password change through the web interface before connecting with FTP; an FTP client cannot complete that prompt.
For people using Files.com two-factor authentication, only the supported protocol-compatible methods work. Parallel connections have additional code-reuse conditions. The Desktop App and CLI answer the second factor once at login and keep parallel transfers available when a person can choose a native app instead.
If a configured connection is rejected, authentication troubleshooting distinguishes credential problems from account restrictions and site access policies.
FTPS Security Modes
Enable TLS encryption in the FTP client. Clients commonly name the options FTPS or FTPeS. Match the selected mode to the command port; Implicit and Explicit describe how encryption starts, independently of whether the data connection uses Active or Passive mode.
Explicit FTPS
Explicit FTPS begins with an FTP command connection, then upgrades it to TLS. Files.com requires the client to request that upgrade with AUTH TLS, as defined in RFC 4217. The client can query supported security mechanisms with FEAT. Select Explicit FTPS on port 21 or 3021; Files.com recommends it for compatibility with modern clients and networks.
Implicit FTPS
Implicit FTPS starts TLS immediately. The client sends a TLS ClientHello at the start of the connection, and Files.com closes the connection if the required TLS handshake is not provided. Select this mode only when the client requires it, using port 990 or 3990.
Data Connections
FTP sends commands and credentials over the command connection and file contents over a separate data connection. The Active or Passive choice determines which side initiates that data connection. Both modes are supported with Implicit FTPS, Explicit FTPS, and plain FTP.
Passive Mode FTP
Use Passive mode whenever possible, especially across firewalls and NAT networks. The client initiates both the command and data connections, so its network does not need to accept a new inbound connection from the server.
In response to PASV, Files.com supplies an address and data port in the range 40000–50000. The client connects to that endpoint for the transfer. Permit outbound connections from the client's network to the full Files.com Passive data-port range as well as the selected command port. Ports Used by Files.com provides the shared network reference.
Active Mode FTP
Active mode requires Files.com to initiate a connection back to the client. The client supplies its address and chosen data port with PORT, and the server connects there for the transfer. This is the connection model defined in RFC 959.
Use Active mode only for client compatibility when the return connection can reach the client. Firewalls and NAT commonly block it. The network administrator must permit inbound connections from Files.com to the client-specified data endpoint; opening a command port alone does not cover that path.
Plain FTP
Files.com requires encryption on FTP connections by default, protecting credentials and contents during transmission. Enable plain FTP only when a client cannot use encryption. Plain connections send credentials and file contents without that protection.
To allow plain FTP across the site, a Site Administrator sets the Plain/unencrypted FTP Support option in the site's FTP service settings. To allow it only for specific users, leave the site-level setting at its default and set each relevant user's Plain/unencrypted FTP support to Allow plain/unencrypted FTP connections.
A plain command connection can reach a site set to Require SSL on all FTP connections because the user's exception is checked during login. Reaching that port does not establish that an unencrypted login is permitted; users without an applicable override must use FTPS.
FedRAMP Security Mode
FedRAMP Security Mode requires SSL on all FTP connections and blocks both site-wide plain FTP and per-user overrides. Update users granted plain FTP access before enabling the mode. While it is enabled, no user can be given the plain-FTP override.
Timeouts, Retries, and Keepalives
Set the client connection timeout to 60 seconds where available. Configure three retries at 10-second intervals. Files.com hostnames resolve to multiple servers in separate data-center locations, so clients should attempt the available addresses rather than retrying only one unreachable server.
Files.com ends FTP sessions idle for more than 60 seconds. If the client needs to keep an idle session open, enable its keepalive feature to send a lightweight command every 30 seconds. Clients can finish transfers in progress and reconnect for new commands; keepalives address idle-session disconnections rather than increasing transfer throughput.
FTP Welcome Message
A Site Administrator can configure the FTP service's welcome message, also called its Message of the Day (MOTD). The client displays it when a user connects over FTP or FTPS. The message supports plain text only.