FTP is reachable from the internet

MediumHigh confidenceQuick winnet.ports.ftp-exposed

What this check looks for

Port 21 on ‹host› accepts connections. FTP sends the username, the password and the file contents in clear text, so anyone able to observe the connection reads all three.

Why it matters

Credentials sent over FTP are readable by anyone on the network path, and FTP servers are a common source of accidental anonymous-write access that turns a site into a file host for someone else's content.

When the check passes, your report says: “No FTP service answered from the public internet”.

What it costs your score

When this check fails it removes 12 points from your Network score, before the status, confidence and repeat multipliers are applied. Network carries a weight of 5 in the overall score.

It shares the network.exposure family ceiling of 60 points: however many findings that family produces, together they cannot remove more than that from Network. One underlying problem showing up in several places is still one problem.

Severity: medium
Default confidence: high
Status when triggered: warn
Deduction: 12 points
Family cap: network.exposure · 60
Category: Network
Module: Net ports
Fix owned by: user
In the ruleset since: 2026.09

How the whole score is calculated

How to fix it

Replace FTP with SFTP, or require TLS and disable anonymous access.

Plaintext FTP exposes credentials to anyone on the network path, and an unnoticed anonymous-write configuration turns the server into someone else's file host.

Check whether anything still uses FTP. On most machines the answer is a deployment script that SFTP would serve equally well.
If nothing needs it, stop and disable the FTP service and deny port 21 at the firewall.
If it must stay, use SFTP over SSH instead — it needs no new service on a machine that already runs SSH.
Where FTPS is the only option, configure the server to *require* TLS for both the control and data channels rather than offering it, and disable anonymous logins explicitly.

How to confirm it worked

nc -z -w 3 ‹host› 21 — should fail once the service is removed
curl -v ftp://‹host›/ --user anonymous: — should be refused

A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.

Remediation by platform

Linux host

# Confirm nothing still depends on it, then remove the service entirely.
sudo systemctl status vsftpd proftpd pure-ftpd 2>/dev/null
sudo systemctl disable --now vsftpd
sudo ufw deny 21/tcp

# If it has to stay: require TLS and refuse anonymous logins (vsftpd).
#   ssl_enable=YES
#   force_local_logins_ssl=YES
#   force_local_data_ssl=YES
#   anonymous_enable=NO

Cloudflare

Cloudflare's proxy only carries HTTP and HTTPS traffic, so no Cloudflare setting closes a database or remote-administration port. If the origin's address is publicly known, the port is reachable regardless of what the DNS record says.

force_local_logins_ssl and force_local_data_ssl are the directives that make TLS mandatory. ssl_enable=YES alone only offers it, and a client that does not ask still sends the password in clear text.
Listed to rule it out. The fix is at the host firewall or the cloud provider's security group. Cloudflare Tunnel or Access can replace a direct exposure once the port itself is closed.

Technical detail

A TCP connection to ‹host›:21 completed. ‹implication›

We did not log in, so this finding does not claim anonymous access is enabled — only that the service is reachable. Two things are worth checking yourself: whether the server permits anonymous logins, and whether it requires an encrypted session.

**FTPS and SFTP are not the same thing and both are better than this.** SFTP runs over SSH on port 22 and is usually already available on a machine that has SSH; FTPS is FTP with TLS and needs explicit configuration to *require* rather than merely offer it. An FTP server that offers AUTH TLS but does not require it still accepts a plaintext login, which is the condition that matters.

Where the FTP server exists only for deployments, replacing it with SFTP or with a deployment pipeline removes the exposure rather than protecting it, and is usually less work than hardening it.