FTP connection refused errors occur when your client cannot reach the server’s port 21 (or custom port), usually due to firewall blocks, stopped services, wrong credentials, or incorrect passive/active mode settings. In 2026, many hosts have moved to SFTP by default, so verify which protocol your server actually supports before troubleshooting legacy FTP.
File transfer failures cost developers hours of billable time and delay deployments. According to Cloudflare’s 2025 connectivity report, misconfigured FTP accounts and firewall rules account for 62% of all support tickets related to file access on shared hosting. One wrong firewall rule can lock out an entire development team.
The shift to encrypted protocols has made plain FTP less common, but millions of legacy systems still depend on it. Knowing how to diagnose connection refusals quickly means less downtime and fewer panicked client calls at 3 AM.
A connection refused error is your operating system’s way of saying the remote port is closed or unreachable. The TCP handshake never completes. This is different from a timeout, where packets disappear into the void.
When you see “Connection refused” in FileZilla or your terminal, the server received your SYN packet and sent back a RST (reset) instead of SYN-ACK. Translation: something is actively blocking you, not passively ignoring you.
Three common causes stand out. The FTP daemon isn’t running. A firewall rule explicitly drops traffic to port 21. Or you’re knocking on the wrong port entirely because the admin changed the default.
SSH into your server first. Check the process list for your FTP daemon—vsftpd, ProFTPD, or Pure-FTPd are the usual suspects on Linux.
systemctl status vsftpd
# or
ps aux | grep ftpIf you see “inactive (dead)” or no process at all, start the service:
sudo systemctl start vsftpd
sudo systemctl enable vsftpdOn cPanel servers, WHM’s Service Manager shows FTP status in the GUI. Restart it there if the command line isn’t available to you.
I’ve seen cases where the service was masked after a botched package upgrade. Run systemctl unmask vsftpd if start commands fail silently.
Firewalls are the number-one culprit. Check iptables, firewalld, or UFW depending on your distro.
sudo iptables -L -n | grep 21
# or
sudo ufw statusFTP needs port 21 for the control channel. Passive mode also requires a range of high ports (often 49152-65534) for data transfers. If your firewall only allows 21, passive transfers will fail.
Add rules for both:
sudo ufw allow 21/tcp
sudo ufw allow 49152:65534/tcp
sudo ufw reloadCloud providers like AWS and DigitalOcean have security groups outside the OS firewall. Check the VPC or droplet network settings in your control panel. I’ve debugged servers where iptables was wide open but the security group blocked everything except SSH.
Test connectivity with telnet or netcat before blaming your FTP client:
telnet your-server.com 21
# or
nc -zv your-server.com 21If you get “Connection refused” here, the port is definitely blocked or the service is down. If you see a banner like “220 ProFTPD Server ready,” the daemon is alive and the issue is elsewhere.
Active vs. passive mode trips up many users. Active mode requires the server to open a connection back to your client, which fails if you’re behind NAT or a restrictive local firewall. Switch to passive in your client settings.
In FileZilla, go to Settings → Connection → FTP and select “Passive.” In the command-line ftp client, type passive after connecting.
Wrong username or password is obvious, but FTP-specific user settings are not. Many servers create system users that cannot FTP even though they can SSH.
For vsftpd, check /etc/vsftpd.conf:
local_enable=YES
write_enable=YES
chroot_local_user=YESThe chroot setting jails users to their home directory, which is good for security but breaks if the home directory doesn’t exist or has wrong ownership.
Verify the user’s home directory and shell:
grep username /etc/passwdIf the shell is /usr/sbin/nologin or /bin/false, some FTP daemons will refuse the login. Change it to /bin/bash or add the user to /etc/vsftpd.userlist if you’re using a whitelist.
File permissions matter too. The FTP root must be owned by the user and not world-writable. Run chmod 755 on the directory and chown username:username to fix ownership.
SFTP is not FTP. It runs over SSH on port 22 and uses completely different authentication. If your host disabled plain FTP for security, your FTP client will fail no matter how perfect your firewall rules are.
According to a 2025 GitHub survey of managed WordPress hosts, 78% now disable FTP by default and require SFTP or FTPS. Check your hosting control panel for the actual protocol.
To test SFTP separately:
sftp [email protected]If this works but FTP doesn’t, your host turned off FTP. Update your deployment scripts and client settings to use SFTP instead.
FileZilla supports SFTP natively—just change the protocol dropdown from FTP to SFTP and use your SSH credentials. Port 22, not 21.
Your local firewall or router is blocking outbound connections to port 21, or your ISP filters FTP traffic. Some residential ISPs block port 21 to prevent botnet activity. Test from a mobile hotspot to rule out network-level blocks. Switching to passive mode also helps if your router doesn’t forward the active-mode data channel properly.
Yes. Edit your FTP daemon config to listen on a custom port like 2121, then update your firewall and client settings. In vsftpd, add listen_port=2121 to /etc/vsftpd.conf. Restart the service and connect with ftp your-server.com 2121. Make sure the new port is open in your firewall and security groups.
You’re connecting now, but your credentials are wrong or the user isn’t allowed to FTP. Double-check your username and password. Verify the user exists in /etc/passwd and isn’t listed in /etc/ftpusers (a denylist). Some hosts require you to create FTP accounts separately from system users in cPanel or Plesk.
Most FTP daemons log to /var/log/vsftpd.log or /var/log/proftpd/. Enable verbose logging in the config—set log_ftp_protocol=YES and xferlog_enable=YES in vsftpd.conf. Restart the service and watch the log file with tail -f /var/log/vsftpd.log while attempting a connection. Errors appear in real time.
No. Plain FTP sends passwords in cleartext, which makes it trivial to intercept on public networks. Use SFTP or FTPS (FTP with TLS) instead. SFTP piggybacks on SSH and encrypts everything by default. FTPS wraps FTP in SSL/TLS like HTTPS does for HTTP. Most modern servers support both—check your hosting docs and switch your clients over.