Configure FTPS Explicit TLS in FileZilla Site Manager

The problem: plain FTP by default, encrypted file drops by requirement

Your team receives an FTPS endpoint for an internal file drop. You open FileZilla Client, create a quick connection, and the server either rejects the session or accepts the login but never returns a directory listing. The default behavior in FileZilla is not always explicit encryption, and FTPS behaves differently from SFTP even though both sound secure.

The practical takeaway: use Site Manager to force explicit TLS on the control channel, accept the server certificate once, verify passive-mode data ports through any firewall, and treat saved passwords as obfuscated rather than encrypted.

Configure an explicit FTPS site in Site Manager

Open FileZilla Client and choose File > Site Manager (shortcut Ctrl+S). Click New site and fill in:

• Host: the FTPS host name, for example ftp.example.com
• Protocol: FTP - File Transfer Protocol
• Encryption: Require explicit FTP over TLS
• Logon type: Ask for password unless you are ready to manage saved credentials
• User: your account name

Selecting Require explicit FTP over TLS tells FileZilla to issue AUTH TLS on the control channel before sending the username and password. Use plain FTP sends both channels unencrypted. These are not the same as SFTP, which uses SSH and is selected as a separate protocol in FileZilla.

Note: Menu labels and configuration file paths can vary between FileZilla Client 3.x stable releases and development builds. Check the exact encryption wording in your installed version before following these steps.

Certificate trust is local and one-time

When you connect, the server may present a self-signed or otherwise unknown certificate. FileZilla shows a trust dialog. If you accept it, the decision is stored locally so later connections skip the prompt. There is no central certificate store to push to teammates; each client machine must make its own trust decision or the prompt reappears.

When the directory list hangs: passive mode and firewalls

FTPS uses two channels: the control channel for commands and the data channel for listings and transfers. FileZilla defaults to passive mode, which usually works through client-side NAT. However, the server must advertise a reachable external address and open its passive port range on any intermediate firewall.

If login succeeds but a directory listing or transfer stalls:

1. Open Site Manager, edit the site, and open Transfer Settings.
2. Confirm Transfer mode is set to Passive.
3. Ask the server administrator for the passive port range and external IP, then verify those ports are open between your client and the server.
4. As a diagnostic, temporarily switch to Active only if your client firewall allows inbound data connections and you understand the exposure; passive is generally safer for clients behind NAT.

Saved passwords are obfuscated, not encrypted

FileZilla writes Site Manager profiles to user-specific application data. On Windows this is typically %APPDATA%\FileZilla\sitemanager.xml; on Linux, ~/.config/filezilla/sitemanager.xml. You can confirm the file exists from a user terminal:

Windows Command Prompt:
dir "%APPDATA%\FileZilla\sitemanager.xml"

Linux or macOS terminal:
ls ~/.config/filezilla/sitemanager.xml

Run this as your normal user; no administrator permission is needed. The command is read-only. The risk is only that opening or editing the XML by hand could corrupt the profile if you introduce malformed tags.

Saved passwords are protected by obfuscation unless you configure a master password in FileZilla. Treat the file as potentially readable by other local processes running under your account. For engineering teams, do not copy sitemanager.xml between machines as a credential distribution method.

Worked example: connecting to an internal FTPS drop

Suppose your operations team provides host ftp.internal.example.com and user deploy. In Site Manager:

1. Create Internal FTPS drop.
2. Set Host to ftp.internal.example.com, Protocol to FTP - File Transfer Protocol, Encryption to Require explicit FTP over TLS, Logon type to Ask for password, and User to deploy.
3. Click Connect. Enter the password when prompted.
4. If a certificate dialog appears, inspect the issuer and fingerprint with the server team, then accept only if they match.
5. Request /uploads and upload a small test file. If the listing appears and the transfer completes, both the control and data channels are working.

To undo the configuration change, open Site Manager, select the site, and delete it. FileZilla removes the entry from sitemanager.xml.

Comparison: plain FTP, explicit FTPS, and SFTP

Choice	Control channel	Data channel	FileZilla protocol
Plain FTP	Unencrypted	Unencrypted	FTP - File Transfer Protocol, encryption Use plain FTP
FTPS explicit	TLS after AUTH TLS	TLS when negotiated	FTP - File Transfer Protocol, encryption Require explicit FTP over TLS
SFTP	Encrypted over SSH	Encrypted over SSH	SFTP - SSH File Transfer Protocol

Limitations and how to verify

• Certificate acceptance is per-client, not centrally managed. A team rollout means repeated prompts unless every client trusts the same certificate.
• Obfuscated passwords are not a vault. Use Ask for password or set a master password if you must store credentials.
• Passive mode depends on the server's published address and firewall rules, which FileZilla cannot control.

Verify the result by connecting, accepting the certificate, listing a directory, and uploading or downloading one small file. Then locate sitemanager.xml using the command above to confirm where the profile was persisted. If anything fails, check the server's passive port range and firewall before changing client encryption settings.

Closing

FTPS in FileZilla works reliably when encryption, certificate trust, and passive data ports are all aligned. Configure the site explicitly in Site Manager, do not rely on saved passwords without a master password, and verify with a real listing and transfer before declaring the connection ready for production use.