FTP: what it is and when it is still used
FTP (short for File Transfer Protocol) is one of the oldest and best-known network protocols, designed for transferring files between a computer and a server. Simply put, it lets you connect to a server, browse the folders on it, upload new files, download existing ones, or replace them. Although most content management systems and cloud solutions today offer more convenient ways to manage files, the FTP principle is still relevant in certain technical situations.
However, it is important to understand that classic FTP is not considered a secure option. It transmits login details and other information in unencrypted form, so if used incorrectly it can pose a risk to an organisation’s data. For this reason, safer alternatives are more often used in modern practice — SFTP and FTPS, which provide an encrypted connection.
What is the difference between FTP, SFTP and FTPS?
Although these names are often mentioned together, they are not the same. FTP is the basic file transfer protocol, created at a time when security requirements on the internet were much lower. SFTP works over an SSH connection and ensures secure, encrypted data transfer, so today it is most often recommended as the practical standard. FTPS is an FTP version with SSL/TLS encryption, which can also be suitable if the infrastructure has already been adapted for such use.
In the Lithuanian public sector, where data on residents, pupils, employees or cultural institution visitors is processed, security is not an extra feature — it is a necessary condition. Municipalities, schools, libraries, museums and other public bodies should avoid using unencrypted FTP and choose only secure transfer methods. This is important not only from a technical point of view, but also from a legal one, especially when assessing GDPR requirements and general information security practice.
When are FTP-type solutions still useful?
Although most modern websites are managed through a browser, file transfer protocols still have their place. They are especially useful when you need to work quickly and reliably with a large number of files or access the server structure directly. In such situations, SFTP often becomes a convenient technical tool for IT specialists or external service providers.
- Bulk file upload
If you need to upload many documents, photos, digital publications or website files at once, SFTP can be much more convenient than manual uploading through the administration system. This is relevant, for example, for museums publishing digitised collections, libraries managing document archives or municipalities transferring larger sets of public information.
- Downloading backups
Backups of websites or systems stored on servers are often accessed precisely through file transfer tools. For IT administrators, this allows them to quickly download copies for storage, audit or recovery after an incident. For public bodies, this is especially important in ensuring business continuity and readiness for technical disruptions.
- Editing configuration files
In some cases, it is necessary to access server configuration files that cannot be edited through a standard content management system. This may be related to website operating settings, redirects, language management or technical security parameters. Such work should be carried out carefully, only with clear access rights and a change management procedure.
Risks that must be assessed
When using file transfer protocols, the main risk is improperly protected login details. If plain FTP is used, the username and password can be intercepted, which would open the way to unauthorised access to the server. On public sector websites, this can mean not only technical disruptions, but also reputational damage or even a personal data security breach.
Another important risk is overly broad access. If several employees or contractors use a shared server login, it becomes difficult to trace who made changes and when. It is therefore recommended to use individual accounts, limit access rights according to need, and log actions, especially if sensitive documents or system files are stored on the servers.
Accessibility, compliance and good practice
Although FTP itself is not related to website design or the user interface, its use can affect the overall quality of a digital service. For example, incorrectly uploaded documents, images without alternative text or unreviewed PDF files can reduce the website’s accessibility. Therefore, technical file transfer alone is not enough — it is important to ensure that the uploaded content meets accessibility requirements and is suitable for all users.
Data protection principles must also be followed. If documents containing personal data are transferred via SFTP, the organisation must ensure that only authorised persons have access and that the transfer process is secure and justified. In the context of GDPR, this means not only technical encryption, but also clear internal rules: who can upload files, where they are stored, how long they are kept, and how they are deleted when no longer needed.
What is recommended for public-sector organisations?
Municipalities, schools, libraries, museums and other public-sector organisations are recommended to use only SFTP or other secure file transfer methods. If file transfer is needed in day-to-day operations, it is worth establishing a clear access management procedure, two-factor authentication, regular password updates and a backup policy. It is also useful to review periodically whether all active logins are still needed.
In short, the concept of FTP is still important, but in practice classic FTP should today be replaced by safer solutions. Used properly, SFTP can be a reliable tool for technical work, but only when it is integrated into the organisation’s overall security, accessibility and compliance process.