Security Experts Urge Companies to Abandon FTP Servers as 6 Million Remain Exposed

Quick Facts

• Nearly 6 million FTP servers remain exposed on the internet, down 40% from 10.1 million in 2024
• About 2.45 million hosts lack encryption, transmitting data in cleartext
• Over 150,000 Microsoft IIS FTP services have misconfigured TLS settings that accept unencrypted credentials

Security researchers are calling for the complete abandonment of FTP servers as new data reveals nearly 6 million internet-facing hosts still run the decades-old File Transfer Protocol.

The April 2026 report by Censys researcher Himaja Motheram found that while FTP usage dropped 40% from 10.1 million servers in 2024, the remaining 5.94 million exposed hosts pose significant security risks due to widespread misconfigurations and inherent protocol vulnerabilities.

“If FTP is showing up in your asset inventory, the first question isn’t how to harden it, it’s whether it should be running at all,” security experts told TechRadar.

The United States leads globally with over 1.2 million visible FTP hosts, followed by China, Germany, Hong Kong, and Japan. These five countries account for more than half of all exposed FTP servers worldwide.

About 2.45 million hosts lack encryption entirely, creating risks for cleartext data transmission. Even servers configured for encryption face problems. Over 150,000 Microsoft IIS FTP services return error codes indicating TLS was never properly configured, despite appearing to require encryption.

“While IIS defaults to a policy that appears to require encryption, it does not bind a security certificate upon a fresh installation,” the research found. “Consequently, the server accepts cleartext credentials, even though the configuration appears to enforce TLS.”

The security vulnerabilities extend beyond configuration issues. Researchers discovered 1,744 internet-facing hosts running the backdoored vsftpd 2.3.4 version from 2011. Pure-FTPd dominates with roughly 1.99 million services, largely because cPanel hosting environments include it by default.

Recent attacks highlight the ongoing risks. In March 2026, CISA added Wing FTP Server vulnerabilities to its Known Exploited Vulnerabilities catalog after confirming active exploitation.

“An unauthenticated attacker can escalate their privileges to the highest possible ones, which usually always means a total server compromise, including all secrets such as passwords,” said Julien Ahrens, a penetration tester at RCE Security.

The business impact extends beyond technical risks. FTP cannot meet federal compliance requirements in many sectors. In 2017, the FBI issued warnings about potential healthcare data breaches from organizations using unsecured FTP.

Verizon’s 2025 Data Breach Investigations Report identified network protocol vulnerabilities, including legacy file transfer systems, as significant attack vectors for cybercriminals.

Security experts recommend immediate action. Organizations should first evaluate whether FTP needs to run at all. If file transfer is necessary, they should migrate to SFTP, which encrypts both credentials and data by default over SSH.

For existing IIS deployments that cannot be immediately replaced, administrators must verify that valid certificates are bound to sites and SSL policies actually enforce TLS.

The research shows most FTP exposure results from forgotten default configurations rather than deliberate administrative choices. “The dominant story of FTP exposure in 2026 is not purpose-built file transfer infrastructure, but rather an accumulation of platform defaults on shared hosting networks,” Censys found.

Read more: Security experts explain why you really shouldn’t be running FTP servers anymore