Connect with Explicit FTP over TLS Without Downgrading Security

FTPS protects FTP with TLS. It is not SFTP, which uses SSH. Require the mode supported by the provider and verify the service identity; a connection to port 21 alone is not encrypted.

Configure explicit FTPS in FileZilla

1. Obtain the exact service hostname, username and connection settings through the authenticated account or support ticket.
2. Open File > Site Manager and create a site entry.
3. For explicit FTPS, select the FTP protocol and the option requiring explicit FTP over TLS. Port 21 is common, but use the provider’s actual value.
4. Choose an appropriate credential-storage/logon option and the exact account username. Do not use root credentials or include passwords in shared screenshots.
5. Connect only after validating the certificate and intended hostname, then check that both commands and data transfers use TLS.

Verify the hostname and current TLS

Use the endpoint name covered by the actual service certificate. In cPanel’s FTP configuration this is normally the server hostname, not an arbitrary hosted website name or IP. Do not click through a name mismatch merely because the credentials appear correct.

The old blanket TLSv1/128-bit statement is obsolete. TLS 1.0 and 1.1 are deprecated; use maintained client/server configurations supporting TLS 1.2 or later as appropriate. Encryption strength and negotiated parameters depend on the real connection, not this article.

Data connections need separate reachability

FTP uses a control connection and separate data connections. Passive mode needs the server’s configured data-port range and correct NAT advertisement to be reachable. Ports 131 and 194 are not a generic FTPS firewall fix. Have the administrator review the actual service/firewall design rather than opening unrelated ports or disabling TLS inspection/security globally.

If TLS login succeeds but listing fails, preserve redacted client/server logs and diagnose that phase. Never switch to plain FTP or disable certificate verification as a workaround. See the passive-listing diagnosis for cPanel scope.

References: FileZilla Site Manager, cPanel endpoint requirements and TLS deprecation.

Reviewed October 16, 2026. No TLS handshake, certificate, firewall, account or live transfer was changed or tested.