Configuring FileZilla Server on Windows

FileZilla Server answers incoming FTP and FTPS connections on a Windows machine — a desktop tucked in a corner, or a proper Windows Server. The steps below take it from a fresh install to a working, encrypted login that a colleague can actually use. Download links point to the FileZilla Project's own pages; nothing is mirrored here.

What the server is for

Instead of emailing large files or renting cloud storage, you publish a folder from a machine you own. Each account you create is mapped to a directory, granted read or write rights, and reached with any FTP client — including FileZilla Client on another PC.

Installation

1. Download the Windows server build from the project download page.
2. Run setup as an administrator and install it as a Windows service so it starts with the machine, with no one logged in.
3. Keep the administration interface listening on localhost only unless you genuinely need remote administration.
4. Set a strong administration password when prompted; it protects every setting.

First configuration pass

• Listening port — 21 is conventional; a different number reduces background scanning noise but has to be told to every client.
• Passive mode range — define an explicit range (for example 50000–50100) so you know exactly what to forward.
• External IP — set it, or the server will advertise a private address to clients outside your network.
• Logging — enable a log file with rotation before you need it, not after.

Creating users and shares

1. Open the users dialog and add an account with its own password.
2. Mount one native folder as that user's home directory. Keep it away from system paths and from anything you would not want overwritten.
3. Grant permissions deliberately: read and list for someone collecting files, write and append for someone delivering them.
4. Group several accounts that share a folder so a rights change applies once instead of five times.

Turning on FTPS

Plain FTP sends the password as readable text, so enable TLS before anyone logs in. The server can generate a self-signed certificate, which encrypts the session but makes clients warn about trust; a certificate from a public authority avoids that warning. Once TLS is active, require it for all connections rather than leaving plain FTP as a fallback.

Firewall and router

• Allow the server executable through Windows Defender Firewall, private and public profiles as appropriate.
• Forward the control port and the passive range from the router to the machine's LAN address.
• Give the machine a fixed local IP so the forwarding rules keep matching.
• Test from outside your network — a login that works on the LAN proves nothing about the internet.

Testing the client side

Connect from another PC using the account you just made, with "Require explicit FTP over TLS". Upload a small file, download it back, then delete it. If any step fails, the server log and the client message log together name the culprit.

Common errors

• Connection refused — service stopped, wrong port, or the firewall rule never applied.
• Login works, listing hangs — passive range not forwarded, or the external IP left blank.
• 530 login incorrect — password typo, or the account is disabled.
• 550 permission denied — the mount point exists but the account lacks write rights, or Windows NTFS permissions block the service account.
• Certificate warnings on every login — expected with a self-signed certificate; replace it to stop them.

Frequently asked

Related guides

• FileZilla Server download options
• Diagnosing failed FTP connections
• Project server documentation