Free tools Windows power users keep installed
One-click scans. No signup required.
To set up FTPS for WordPress on Ubuntu, install vsftpd, create a dedicated non-root account, restrict it to the WordPress files it must access, install a certificate issued for the server’s hostname, force TLS for both authentication and file transfers, and open a narrow passive-port range in every firewall between the client and server. Then configure WordPress or its filesystem client to use the ftps method rather than plain FTP.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
Use explicit FTPS (also called FTPES) unless a particular client or policy requires implicit FTPS. Explicit FTPS normally starts on the FTP control port, commonly TCP 21, and upgrades that connection to TLS. Implicit FTPS commonly uses TCP 990 and starts inside TLS immediately. These modes are not interchangeable, which explains many “login works but uploads hang” failures.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →What FTPS is—and when SFTP is the better choice
FTPS is ordinary FTP protected by TLS. It retains FTP’s separate control and data channels, so clients, firewalls and NAT devices must handle both the login connection and a negotiated data connection for directory listings, uploads and downloads.
SFTP is a different protocol: it is a file-transfer session carried over an encrypted SSH connection. It does not use FTP commands, FTP certificates or FTP passive ports. Ubuntu’s server documentation explicitly distinguishes the two and recommends considering OpenSSH/SFTP when secure file transfer is the only requirement.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
| Area | FTPS | SFTP |
|---|---|---|
| Underlying protocol | FTP secured with TLS | Separate SSH-based file-transfer protocol |
| Connections | Control channel plus a data channel | One SSH connection carrying the session |
| Firewall work | Control port and a passive data-port range must be reachable; NAT may need a public address configured | Usually one SSH port, commonly TCP 22 |
| Server identity | Host certificate and private key | SSH host keys; users may also authenticate with SSH keys |
| Client compatibility | Requires an FTP client that supports explicit or implicit TLS | Requires an SFTP-capable SSH client; an FTP-only client cannot use it |
| Account isolation | Use a dedicated account and vsftpd chroot or equivalent restrictions | Use SSH account restrictions, a chroot or a restricted subsystem |
Choose SFTP if you control both ends and have no FTP-specific compatibility requirement. Choose FTPS when an existing WordPress workflow, deployment tool or client explicitly requires FTP with TLS. Do not call an SFTP connection “FTPS”; changing the port does not convert one protocol into the other.
Plan the Ubuntu installation before changing configuration
Decide these values first. Writing them down prevents a successful login from leading to an unusable WordPress connection.
- Hostname: the DNS name clients will use. The TLS certificate should identify this name.
- WordPress root: the actual installation directory on the server.
- Writable path: normally the required
wp-content/uploadstree, not the entire operating-system filesystem. - Transfer account: a dedicated, non-root user used only for this site or transfer job.
- Mode: explicit FTPS unless an application specifically asks for implicit FTPS.
- Control port: normally TCP 21 for explicit FTPS. If you deliberately choose another port, use that same value in the client and firewall.
- Passive range: a small, unused TCP range that you can allow in UFW, cloud security groups and any perimeter firewall.
Keep the transfer account separate from the account used for SSH administration. A WordPress upload credential should not provide shell access, root access or write access to unrelated sites.
Install vsftpd and create an isolated account
Install the service
- Update the package index and install the Ubuntu package:
sudo apt update sudo apt install vsftpd - Back up the original configuration before editing it:
sudo cp /etc/vsftpd.conf /etc/vsftpd.conf.backup - Create a dedicated account. Replace
wptransferwith your own name:sudo adduser --disabled-password --shell /usr/sbin/nologin wptransfer sudo passwd wptransferUse a long, unique password stored in your password manager. Never use the root account for WordPress transfers.
The account’s home directory should be the directory you intend to expose, or a controlled parent from which the account can reach the required WordPress path. A chroot prevents the account from browsing above that boundary.
Configure the chroot deliberately
In /etc/vsftpd.conf, enable local users and chroot them to their intended home:
local_enable=YES
write_enable=YES
chroot_local_user=YESUbuntu documents additional chroot-list controls when you need exceptions. Avoid making the whole server writable merely to solve a path problem; correct the account’s home, ownership and group membership instead.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteRank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
An account whose shell is /usr/sbin/nologin may be rejected by PAM if that shell is not listed in /etc/shells. Ubuntu notes this interaction. If you intentionally use a nologin account, verify the shell policy on your system and add it to /etc/shells only when that design is understood and approved. Do not give the account an interactive shell simply to make an FTP login succeed.
Set WordPress ownership and least-privilege write access
Find the real WordPress installation rather than assuming it is under /var/www/html. The uploads directory is commonly wp-content/uploads, but a site can use a different document root or a customized content directory.
WordPress hardening guidance recommends locking down permissions and loosening them only for a feature that genuinely needs writing. The transfer account should therefore receive only the ownership or group permissions required for the target path. A typical arrangement is:
- The web-server account retains ownership of the application files, or the site uses a carefully managed shared group.
- The transfer account is a member of that group only when necessary.
- Write permission is granted to
wp-content/uploadsand any other directory that the chosen workflow must modify. - WordPress core, configuration files and unrelated sites remain non-writable to the transfer account.
Inspect every directory in the path, not just the final folder. The account needs execute permission on parent directories to traverse them and write permission on the exact destination. After changing ownership or modes, test with a small file and remove it; do not respond to an error by applying broad write permissions recursively to the whole site.
Recommended Free Tools
Enable explicit FTPS with a host-specific certificate
Install the right certificate and key
A production service needs a certificate issued for the hostname clients will verify and the corresponding private key. Ubuntu installations may contain a default “snakeoil” certificate for local testing; replace it for production. Keep the private key readable only by root and the service process as required by your certificate layout.
Obtain the certificate from a trusted certificate authority or your organization’s PKI. Confirm that the certificate’s names include the exact hostname used by WordPress or the FTP client. A certificate for an IP address or a different alias can produce a hostname-mismatch warning even when the password is correct.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Set the TLS directives
Add or update these settings in /etc/vsftpd.conf:
ssl_enable=YES
rsa_cert_file=/etc/ssl/your-host/fullchain-or-certificate.pem
rsa_private_key_file=/etc/ssl/your-host/private-key.pem
force_local_logins_ssl=YES
force_local_data_ssl=YES
ssl_sslv2=NO
ssl_sslv3=NOUse the actual certificate and key paths on your server. force_local_logins_ssl=YES prevents credentials from being sent over an unencrypted login. force_local_data_ssl=YES protects directory listings, uploads and downloads as well.
The current Ubuntu vsftpd documentation describes TLS 1.2 and TLS 1.3 as enabled by default in the documented version and prefers TLS 1.2 or newer. Keep SSLv2 and SSLv3 disabled. Do not enable obsolete protocol switches just to accommodate an old client; update or replace that client instead.
Explicit versus implicit FTPS
With explicit FTPS, the client connects to the FTP service (normally TCP 21) and requests TLS using the normal FTP workflow. This is the preferred arrangement for most new deployments because it is widely supported and keeps the control-port choice familiar.
Implicit FTPS is a separate mode in which TLS begins immediately. TCP 990 is the commonly used default, but the port number alone does not select the mode. A client set to implicit FTPS will fail against a server expecting explicit negotiation, and vice versa. Change implicit_ssl or other mode settings only when the client or policy specifically requires them.
Configure passive mode and every firewall
FTP’s data channel is the reason a login can succeed while a listing or upload hangs. In passive mode, the server tells the client which temporary port to connect to. Select a narrow range and use the same range in vsftpd and every network control point.
For example:
pasv_min_port=12000
pasv_max_port=12100This example permits 101 passive TCP ports. You may choose another unused range; the important requirement is consistency. Allow the control port and that exact range in:
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
- Ubuntu’s UFW rules;
- the cloud provider’s security group or network ACL;
- any hardware or software firewall in front of the server; and
- the hosting or data-center perimeter if one exists.
For the example range, UFW commands would be:
sudo ufw allow 21/tcp
sudo ufw allow 12000:12100/tcpIf you use another control port, substitute it for 21. Do not open a large, arbitrary port span when a small range is sufficient.
Account for NAT
When the Ubuntu host sits behind NAT, passive replies must advertise the public address that clients can actually reach. Configure vsftpd’s public-address setting according to your network design and ensure the router forwards the control port and the complete passive range to the server. A private address in the passive response causes external clients to wait for an unreachable connection.
In a cloud environment, check both the instance firewall and the provider security group. Opening UFW alone does not make the ports reachable if the security group denies them.
Restart vsftpd and validate the complete path
- Restart the service after editing the configuration:
sudo systemctl restart vsftpd - Check the service state and review system logs for syntax, certificate or permission errors:
sudo systemctl status vsftpd sudo journalctl -u vsftpd --no-pager - Connect from an FTPS-capable client in passive mode. Select explicit FTPS unless your design calls for implicit FTPS.
- Confirm that the client displays a TLS-protected login and validates the expected hostname.
- List the target directory. A successful login without a successful listing is evidence of a data-channel or path problem, not proof that the setup is complete.
- Upload a small test file into the intended WordPress directory, confirm its ownership and location on the server, then download it.
- Delete the test file and repeat the check through the WordPress operation that originally required FTP access.
These checks validate authentication, certificate negotiation, passive networking, chroot navigation and filesystem permissions separately. Test from the same network where the real WordPress client runs; an internal test can work while an external firewall still blocks passive ports.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Configure WordPress or its filesystem client
WordPress’s WP_Filesystem_FTPext implementation accepts ftps as the method value for an SSL-protected FTP connection and accepts a server port. The setup flow or client must explicitly select FTPS; selecting plain FTP and merely entering port 21 does not enable encryption.
Enter the values that match the server:
| Field | Value to provide |
|---|---|
| Connection method | ftps, FTP over TLS, or the client’s equivalent explicit-FTPS label |
| Server | The DNS hostname covered by the certificate |
| Port | TCP 21 for explicit FTPS, unless you deliberately configured another control port |
| Username | The dedicated transfer account, never root |
| Password | The account’s unique password |
| Transfer mode | Passive |
| Remote directory | The chroot-relative path that contains the required WordPress files or uploads directory |
If the client asks whether to trust an unknown certificate, do not permanently bypass verification in production. Fix the hostname, certificate chain or client trust store. A temporary trust decision may conceal an incorrect certificate and expose credentials to an impersonated server.
Troubleshoot by symptom
Login succeeds, but directory listings or uploads hang
Check passive mode first. Confirm that the client’s passive setting is enabled, the configured range matches pasv_min_port and pasv_max_port, and the range is allowed by UFW, the cloud security group and every perimeter firewall. If the server is behind NAT, verify that passive responses advertise the public address. A control connection on TCP 21 can be healthy while every data connection is blocked.
WordPress connects but cannot write
Inspect the exact remote path and the account’s chroot-relative view. Then check ownership and permissions on every parent directory and on the destination itself. Grant write access only to the upload path or other directory that the feature requires. Do not make the entire WordPress tree or the whole filesystem world-writable.
The login is rejected for a nologin account
Check whether the account’s shell appears in /etc/shells. Ubuntu notes that PAM may require this. Add /usr/sbin/nologin only when the account is intentionally designed without interactive shell access and your authentication policy permits it.
The client reports a certificate or protocol error
Replace a default snakeoil certificate with one issued for the server hostname, verify that the private key matches the certificate, and ensure the client supports modern TLS. Keep SSLv2 and SSLv3 disabled and use TLS 1.2 or newer. Also confirm that the client is set to explicit FTPS rather than implicit FTPS.
The client insists on port 990
Determine whether it is requesting implicit FTPS. Port 990 is commonly associated with implicit mode, while explicit FTPS normally starts on TCP 21. Select the mode that matches the server instead of changing the port blindly.
The service fails after a configuration edit
Run sudo systemctl status vsftpd and inspect sudo journalctl -u vsftpd for the first reported error. Common causes include a misspelled directive, an unreadable certificate or key, an invalid path, and a passive range that conflicts with another service. Restore the backup configuration if necessary, then reapply one change at a time.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Self-managed vsftpd or managed hosting?
Running vsftpd yourself gives you control over the certificate, account boundaries, passive range and WordPress path. It also makes you responsible for updates, certificate renewal, firewall changes, log review, backups and recovery when a client or network changes.
| Consideration | Self-managed Ubuntu and vsftpd | Managed WordPress or VPS service |
|---|---|---|
| Operational work | You install, configure, patch and monitor vsftpd, TLS and the operating system. | The provider handles much of the platform maintenance, with scope depending on the service. |
| Access control | You define chroots, account permissions, groups and writable paths. | Controls are constrained by the provider’s platform, but common WordPress operations may be preconfigured. |
| Firewall and networking | You maintain passive ports, NAT rules, UFW and cloud security groups. | The provider may abstract networking or provide a managed transfer mechanism. |
| Customization | Highest: you can choose the certificate layout, ports and account model. | Lower: available protocols and settings depend on the plan. |
| Support responsibility | You diagnose TLS, FTP, WordPress permissions and network failures. | Support may cover some or all of those layers according to the service agreement. |
Choose self-management when you need this control and can maintain it. Choose a managed arrangement when maintaining certificates, passive firewall rules and least-privilege permissions is a larger burden than the site’s transfer requirement justifies. Whatever the platform, retain the same rule: use a dedicated account and grant only the directories WordPress must write.
Production hardening and maintenance checklist
- Use a host-specific certificate and protect its private key.
- Force TLS for both local logins and local data transfers.
- Keep SSLv2 and SSLv3 disabled and use a modern TLS-capable client.
- Prefer explicit FTPS unless an identified client requires implicit mode.
- Use a dedicated non-root account with a deliberate chroot.
- Limit write permission to
wp-content/uploadsor the precise directories required by the workflow. - Allow only the control port and the selected passive range in UFW and upstream firewalls.
- Configure the public passive address when NAT is involved.
- Review service logs after configuration changes and during failed transfers.
- Renew certificates before expiry and retest both listing and upload after renewal.
- Remove unused transfer accounts and rotate credentials when staff, vendors or automation changes.
- Keep an SFTP option in mind when FTP compatibility is not required; it usually avoids FTP’s separate data-channel and passive-port complexity.
The Bottom Line
A reliable Ubuntu FTPS setup is the combination of four controls: a host-specific TLS certificate, encryption enforced for login and data, a narrow passive range open through every firewall, and a dedicated account writable only where WordPress needs it. If you do not need FTP compatibility, SFTP over SSH is usually simpler to operate.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
