Half of the 6 Million Internet-Facing FTP Servers Lack Encryption
Half of 6 million internet-facing FTP servers lack encryption support.
Censys research reveals approximately 6 million internet-accessible FTP servers worldwide, with 2.45 million (41%) showing no evidence of encryption support. The 50-year-old FTP protocol continues to expose enterprises and users to credential theft and data interception despite a 40% year-over-year decline in deployments. Most unencrypted servers are in the US, China, Germany, and Hong Kong, with Pure-FTPd, ProFTPD, and vsftpd being the most common implementations.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonDespite being a 50-year-old protocol with well-known security flaws, FTP continues to be widely deployed without proper encryption, with 2.45 million internet-facing servers lacking encryption support. This exposes organizations to credential theft and data interception, as FTP transmits usernames, passwords, and file contents in plain text. The persistence of unencrypted FTP deployments demonstrates a critical failure in secure configuration practices and highlights the ongoing risk of using legacy protocols without proper security controls.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- External attack surface management (EASM)
You find your forgotten internet-facing systems before attackers do.
- Automated patch management
Known holes get closed in days, not months.