iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
To set up FTPS for WordPress on Ubuntu, install and lock down vsftpd, create a dedicated account, give it access only to the required WordPress directory, install a certificate for the FTP hostname, force TLS for both the login and data channels, and open the control port plus a narrow passive-port range. Configure the WordPress filesystem client for FTPS (FTPES), not plain FTP, then verify a listing, upload, and download.
FTPS is FTP protected by TLS. It is not the same protocol as SFTP, which runs inside SSH. If secure file transfer is your only requirement and your clients support SSH, Ubuntu recommends considering SFTP; FTPS remains useful when an FTP-compatible workflow or WordPress FTP extension is required.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsFTPS, FTPES and SFTP: choose the right protocol first
FTP normally uses a control connection and separate data connections. FTPS adds TLS encryption to that FTP session. In an explicit FTPS (also called FTPES) connection, the client connects to the normal FTP service, usually TCP port 21, and requests TLS before credentials or file data are exchanged. In implicit FTPS, TLS is required immediately, commonly on TCP port 990. The modes are not interchangeable: selecting port 990 in a client configured for explicit FTPES, or selecting explicit FTPES when the server expects implicit TLS, produces confusing connection failures.
SFTP is a different protocol carried over an encrypted SSH connection. It has one SSH connection rather than FTP’s separate control and data channels, and it uses SSH host keys or user keys instead of an X.509 certificate for the transfer service.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application:Upgraded attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Warranty & Support: Our Electric air duster comes with 5 years warranty and 24/7 customer service. During this period, if you have any questions,pls kindly feel free to contact us.
| Concern | FTPS (explicit FTPES) | SFTP |
|---|---|---|
| Underlying protocol | FTP with TLS encryption | File-transfer subsystem over SSH |
| Typical control port | TCP 21; implicit deployments commonly use TCP 990 | SSH port, normally TCP 22 |
| Firewall behavior | Requires the control port and a negotiated passive data-port range | Normally one SSH port; no FTP passive range |
| Server identity | Host certificate and private key | SSH host key; users may authenticate with passwords or SSH keys |
| Client compatibility | FTP/FTPS-capable clients and WordPress FTP extensions | SSH/SFTP-capable clients and WordPress SSH2 support where available |
| Account isolation | Use a dedicated local account, chroot and narrowly scoped permissions | Use a dedicated SSH account, restricted shell or subsystem and narrowly scoped permissions |
For this guide, the examples use explicit FTPS on port 21 with passive mode. Change the port only when your policy or client requires another arrangement, and document the choice for every firewall and client.
What you need before configuring the server
- An Ubuntu server with administrative access and a current security-update process.
- The real WordPress document root and the directories that must be writable. Uploads are commonly under
wp-content/uploads, but the path depends on the installation. - A DNS name that resolves to the server and a TLS certificate whose name matches that FTP hostname. A certificate issued for the website does not automatically cover a different FTP name.
- A dedicated transfer account. Do not use
root, the web-server account, or a shared administrator login. - A planned passive range, such as TCP ports 12000–12100, that can be allowed in UFW, any cloud security group, and every intervening firewall or NAT device.
- An FTPS-capable client for validation and a WordPress filesystem method that explicitly selects FTPS.
1. Install vsftpd and create an isolated transfer account
Install the Ubuntu FTP daemon and enable its service:
sudo apt update
sudo apt install vsftpd
sudo systemctl enable --now vsftpdCreate an account used only for the WordPress transfer. Replace the home directory with the chroot layout you choose:
sudo adduser --home /srv/ftps/wptransfer --shell /usr/sbin/nologin wptransferA chroot prevents the account from browsing outside its assigned tree. With chroot_local_user=YES, the account is confined to its home (or to a configured local root). The chroot’s top directory must not be writable by the account; provide a writable child directory instead. For example:
sudo mkdir -p /srv/ftps/wptransfer/files
sudo chown root:root /srv/ftps/wptransfer
sudo chmod 755 /srv/ftps/wptransfer
sudo chown wptransfer:wptransfer /srv/ftps/wptransfer/files
sudo chmod 750 /srv/ftps/wptransfer/filesYou can use the WordPress site directory itself as the account’s confined tree, but only if its top level is not writable by the transfer account. A separate chroot with a bind-mounted or otherwise deliberately exposed uploads directory is easier to reason about when the site contains private configuration files.
Some Ubuntu PAM configurations require a user’s login shell to appear in /etc/shells. If a deliberately restricted /usr/sbin/nologin account is rejected at login, check the PAM policy and add that shell to /etc/shells only when this account design is intentional. Do not change a service account to a normal interactive shell merely to hide an authentication problem.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
2. Give the account only the WordPress access it needs
Find the actual installation and upload path before changing permissions. Do not assume that the first directory named wordpress is the live site. The transfer account normally needs write access to uploads and, only when a WordPress operation specifically requires it, to another narrowly identified directory.
One group-based pattern keeps the web server as the owner while granting the transfer account access to the uploads tree:
sudo usermod -aG wptransfer wptransfer
sudo chown -R www-data:wptransfer /var/www/example.com/public_html/wp-content/uploads
sudo find /var/www/example.com/public_html/wp-content/uploads -type d -exec chmod 2770 {} ;
sudo find /var/www/example.com/public_html/wp-content/uploads -type f -exec chmod 0660 {} ;The commands assume that a group named wptransfer already exists and that the web server account is www-data. Adapt the owner, group and modes to the account used by your installation. If you do not want a shared group, make the transfer account the owner of only the target directory and preserve read access required by the web server.
Do not solve an upload failure with chmod -R 777 or by making the whole document root writable. WordPress hardening guidance is to lock down files and directories, then loosen permissions only for a feature that genuinely needs writing. Check every parent directory in the path: the account needs execute (directory traversal) permission on parents and write permission only where files are created or removed.
Free tools Windows power users keep installed
One-click scans. No signup required.
3. Install a host-specific TLS certificate
Ubuntu’s package can start with a default “snakeoil” certificate. That certificate is not suitable for a production FTP hostname because clients cannot reliably validate that it identifies your server. Obtain a certificate from a trusted certificate authority for the exact name clients will use, such as ftp.example.com, and keep its private key readable only by root and the FTP service as required by your chosen file layout.
Place the certificate and key at controlled paths, for example:
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
/etc/ssl/certs/ftp.example.com.crt
/etc/ssl/private/ftp.example.com.keysudo chown root:root /etc/ssl/private/ftp.example.com.key
sudo chmod 600 /etc/ssl/private/ftp.example.com.keyIf you use a certificate chain, install the full chain in the certificate file in the format expected by your certificate provider. Set a renewal procedure and reload or restart vsftpd after renewal. A self-signed certificate can help with a closed test environment, but every client must then be configured to trust it; it is not a substitute for a host-validated production certificate.
4. Configure vsftpd for explicit FTPS
Edit /etc/vsftpd.conf. The following is a focused baseline; retain other distribution settings that your environment requires and confirm each option against the Ubuntu manpage for your release:
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →anonymous_enable=NO
local_enable=YES
write_enable=YES
# Confine local users to their home directory
chroot_local_user=YES
# TLS for authentication and file transfers
ssl_enable=YES
rsa_cert_file=/etc/ssl/certs/ftp.example.com.crt
rsa_private_key_file=/etc/ssl/private/ftp.example.com.key
force_local_logins_ssl=YES
force_local_data_ssl=YES
# Passive FTP data ports
pasv_min_port=12000
pasv_max_port=12100
# Keep anonymous TLS paths disabled when anonymous access is disabled
allow_anon_ssl=NO
# Optional: make the server's public address explicit when it is behind NAT
# pasv_address=203.0.113.10ssl_enable=YES turns on TLS. The certificate and key directives identify the server certificate. The two force_local_* directives prevent a local user from authenticating or transferring data over unencrypted FTP. Keeping anonymous_enable=NO removes an unnecessary access path.
Use explicit FTPS unless a client or policy specifically requires implicit FTPS. The implicit mode is separately controlled by implicit_ssl and is commonly associated with port 990. Do not set a client to port 990 simply because it displays an “SSL” option; first determine which mode the server is configured to provide.
Keep SSLv2 and SSLv3 disabled. In the documented current Ubuntu configuration, TLS 1.2 and TLS 1.3 are enabled by default and TLS 1.2 or newer is preferred. Do not enable obsolete protocol switches just to accommodate an old client; replace or update that client instead. If your Ubuntu release exposes protocol-minimum settings, use a TLS 1.2-or-newer minimum consistent with the release documentation.
Before restarting, check for duplicate or contradictory directives and make a backup:
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
sudo cp /etc/vsftpd.conf /etc/vsftpd.conf.backup
sudo editor /etc/vsftpd.conf5. Configure passive mode and every firewall
FTP’s data channel is the reason a login can succeed while a directory listing or upload hangs. In passive mode, the server tells the client which port to use for the data connection. The range in vsftpd.conf must be allowed through all network controls.
For the example range, permit TCP 21 and TCP 12000–12100 in UFW:
sudo ufw allow 21/tcp
sudo ufw allow 12000:12100/tcp
sudo ufw status numberedRepeat the same rules in a cloud security group, hardware firewall and NAT policy. A rule on the Ubuntu host alone is insufficient if an upstream device drops the passive connection. Keep the range narrow enough to audit, but large enough for the number of simultaneous data connections your site requires.
If the server is behind NAT, set pasv_address to the public address or DNS name that clients can reach, not the server’s private address. Ensure that the NAT device forwards both TCP 21 and the complete passive range to the Ubuntu host. If the public address changes, update the setting and the firewall rules together.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Do not mix ranges. A common failure is configuring 12000–12100 in vsftpd while allowing a different range in the security group. The client then receives a port that the network silently blocks.
6. Restart the service and validate the complete transfer path
Apply the configuration and inspect the service immediately:
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
sudo systemctl restart vsftpd
sudo systemctl status vsftpd --no-pager
sudo journalctl -u vsftpd -n 100 --no-pagerUse an FTPS-capable client from a network that represents the real WordPress server or administrator workflow. Select explicit FTP over TLS, passive mode, the dedicated username, the certificate hostname, and port 21. Validate the following in order:
- The client resolves the hostname and establishes the control connection.
- The client displays a successful TLS negotiation before sending credentials.
- Authentication succeeds for the dedicated account and the account lands in its chroot or intended local root.
- A directory listing completes without a timeout.
- A small test file uploads to the intended WordPress directory.
- The same file can be downloaded, and the resulting owner, group and mode are what the web server and WordPress expect.
- Delete the test file through the same least-privilege account if it is not needed.
A successful login proves only that the control channel and credentials work. The listing and upload checks prove that passive ports, routing, chroot placement and filesystem permissions work together.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
7. Configure WordPress to use FTPS, not plain FTP
When WordPress asks for filesystem credentials, enter the FTP hostname, the dedicated username and password, the explicit FTPS control port (normally 21), and passive mode. The WordPress WP_Filesystem_FTPext implementation accepts an ftps method value for SSL and accepts an FTP server port. A client or setup flow that leaves the method as ordinary ftp can appear to connect while violating the encryption requirement or failing when the server forces TLS.
| WordPress/client field | Value for this example | Why it matters |
|---|---|---|
| Host | ftp.example.com |
Must match DNS and the certificate name. |
| Method | ftps or “FTP over TLS (explicit)” |
Requests TLS instead of plain FTP. |
| Port | 21 |
Explicit FTPES control port; use 990 only for a separately configured implicit service. |
| Username | wptransfer |
Dedicated, non-root account. |
| Password | The account’s password | Store it only in the protected credential mechanism used by your WordPress deployment. |
| Transfer mode | Passive | Uses the server’s configured passive range. |
If you are integrating the filesystem class in code rather than using a setup screen, pass the FTPS method, hostname, credentials, port and passive connection setting through the class’s documented arguments. Do not silently fall back to plain FTP when FTPS negotiation fails.
After saving the settings, trigger a small operation that exercises the real path: upload an image or another harmless file, confirm it appears under the expected wp-content/uploads subdirectory, and verify that the web server can still read it. Remove the test object afterward.
Troubleshooting by symptom
| Symptom | Most likely cause | Focused fix |
|---|---|---|
| Login succeeds, but a listing or upload hangs | Passive range is blocked, the NAT address is wrong, or a security group allows port 21 but not the data ports. | Compare pasv_min_port/pasv_max_port with UFW, the security group, NAT forwarding and the client’s passive-mode setting. Set pasv_address when the server is behind NAT. |
Login is rejected for an account using /usr/sbin/nologin |
PAM requires the shell to be listed in /etc/shells. |
Inspect the PAM policy and add the restricted shell to /etc/shells only if the account is intentionally a non-interactive FTP account. |
| WordPress connects but cannot create or replace a file | The account can authenticate but lacks write or traversal permission on the exact target path, or the chroot points somewhere else. | Check the account’s effective group, every parent directory, the upload directory’s owner and mode, and the local-root/chroot mapping. Grant access only to the required directory. |
| Certificate warning or TLS protocol error | The default certificate is still installed, the hostname does not match, the chain is incomplete, or the client is too old. | Install a certificate for the exact FTP hostname, protect the key, configure the full chain as required, and use a modern TLS-capable client. |
| A client insists on port 990 | It is requesting implicit FTPS rather than explicit FTPES. | Choose explicit FTP over TLS on port 21, or deliberately configure and firewall an implicit service. Do not mix the two modes. |
| The service will not restart after editing the file | A typo, duplicate setting or invalid path to the certificate/key prevents startup. | Read systemctl status and journalctl -u vsftpd, restore the backup if needed, then correct one setting at a time. |
| Uploads land outside the expected WordPress directory | The account home, local_root or chroot view does not map to the site’s actual path. |
Log in with the same account, note the starting directory and visible tree, then align the local root with the intended uploads path rather than granting access to the whole server. |
Security and maintenance after the initial setup
- Patch the operating system and vsftpd. Schedule Ubuntu security updates and review service logs for unexpected authentication attempts.
- Keep the account dedicated. Do not reuse its password for SSH, the WordPress administrator account or another service. Disable or remove the account when the integration is retired.
- Rotate certificates and credentials. Renew the host certificate before expiry, update the private key permissions, and reload the service after renewal.
- Restrict network exposure. Allow the control port and passive range only from the networks that need them when your deployment permits source restrictions.
- Protect the chroot. Keep the chroot root non-writable by the transfer account and expose only the directories needed for uploads.
- Review WordPress permissions after plugin changes. A plugin may create a new writable directory; grant access to that path deliberately rather than broadening the FTP account’s scope.
- Monitor disk space and inode usage. A full filesystem can look like an FTP permission failure even when ownership and TLS are correct.
Self-managed vsftpd or managed hosting?
Running vsftpd yourself gives precise control over the certificate, account, chroot, passive range and firewall. It also makes you responsible for patching, certificate renewal, log review, backup, intrusion response and keeping the FTP and WordPress permission models aligned.
Recommended Free Tools
| Decision factor | Self-managed Ubuntu with vsftpd | Managed WordPress or VPS service |
|---|---|---|
| Operational work | You configure and maintain vsftpd, TLS, passive ports, firewall rules and permissions. | The provider may supply the service and defaults, reducing server administration. |
| Access control | Fine-grained control over accounts, chroots, groups and network rules. | Controls depend on the provider’s supported users, protocols and interface. |
| Patching and certificates | Your team owns updates, renewal and key protection. | Some or all maintenance may be handled by the provider; verify what is included. |
| Support | You diagnose protocol, firewall and filesystem interactions. | Support may help with platform-level configuration, subject to the service’s scope. |
| Best fit | Teams that need server-level control and can operate a secure transfer service. | Site owners who prefer to avoid maintaining FTP infrastructure and its network rules. |
Whichever model you choose, the WordPress requirement does not change: write access should be limited to the directories that need it, and the client must use an encrypted transfer method.
Quick Recap
Final verification checklist
vsftpdis installed, enabled and starts without errors.- The transfer account is not
root, is confined to its intended tree and has no unnecessary shell access. - The chroot root is not writable by the transfer account.
- The certificate names the FTP hostname, and the private key is protected.
ssl_enable=YES,force_local_logins_ssl=YESandforce_local_data_ssl=YESare active.- Obsolete SSLv2 and SSLv3 are disabled; the client supports modern TLS.
- TCP 21 and the exact passive range are allowed through UFW, security groups, NAT and perimeter firewalls.
- The transfer account can write only to the required WordPress path.
- The WordPress filesystem method is
ftps, the port and hostname are correct, and passive mode is selected. - A real listing, upload and download have each completed successfully.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
