Censys Warns 6 Million Public-Facing FTP Servers Are Still Exposed in 2026

A new security brief from internet intelligence firm Censys reveals that the 55 year old File Transfer Protocol continues to run on nearly 6 million internet facing hosts.

As of April 2026, the dominant story of FTP exposure is not purpose built file transfer infrastructure, but rather a dangerous accumulation of platform defaults.

Censys researchers report that nearly 6 million public-facing servers are still running legacy FTP protocols globally.

The Current State of FTP Exposure

While the total number of exposed FTP hosts dropped by 40 percent over the past two years, moving from 10.1 million in 2024 to roughly 5.94 million today, the remaining footprint is massive.

These legacy servers are largely concentrated in shared hosting networks and broadband providers. The United States leads globally with over 1.2 million visible hosts. China, Germany, Hong Kong, and Japan follow closely, making up over half of the global total.

The analysis of encryption implementation shows a mixed reality for global server security and enterprise protection.

• Approximately 58.9 percent of FTP hosts successfully completed a TLS handshake, with 97 percent of those using modern TLSv1.2 or TLSv1.3 protocols.
• Roughly 2.45 million hosts showed no evidence of TLS encryption during scanning, leaving them vulnerable to transmitting credentials and files in cleartext.
• Mainland China and South Korea report the lowest TLS adoption rates, driven primarily by residential and legacy hosting setups.
• Japan hosts 71 percent of all FTP servers still running deprecated legacy TLS versions.

To understand the technical risk, it is vital to know the difference between the protocols. Standard FTP transmits everything in cleartext.

FTPS adds TLS encryption to standard FTP, offering a reasonable intermediate step for legacy systems. SFTP, despite the naming similarity, is an entirely different protocol based on SSH.

Experts universally recommend SFTP because it encrypts all data and credentials by default without requiring complex firewall rules. Finally, TFTP is a stripped down protocol lacking authentication entirely and should never face the public internet.

Default Configurations and Technical Risks

Censys research highlights that daemon defaults dictate much of this risk. Pure-FTPd is the most common software, largely due to cPanel default deployments.

Meanwhile, vsftpd remains prevalent, and researchers even spotted 1,744 internet facing hosts running the notoriously backdoored vsftpd 2.3.4 version from 2011.

One of the most critical findings involves Microsoft IIS FTP deployments. Over 150,000 IIS FTP services return a 534 response code.

This happens because the IIS control policy defaults to requiring SSL, but the server certificate hash is empty upon a fresh installation. Without a bound certificate, TLS cannot negotiate.

Administrators might see the policy set to require encryption and falsely believe they are secure, while the server silently accepts cleartext credentials.

Censys researchers urge organizations to rethink their file transfer infrastructure. The primary mitigation strategies include the following steps.

• Evaluate whether FTP needs to be running at all. If it appears in an asset inventory, the best option is often to disable it entirely.
• Migrate to a more secure alternative like SFTP, which runs securely over SSH and encrypts both credentials and data by default.
• For existing IIS FTP deployments, administrators must verify that a valid certificate is bound to the site and that the SSL policy actually enforces TLS.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.