Port 21: FTP control
Control channel for FTP logins and commands.
- Port
- 21
- Protocol
- TCP
- Service
- FTP control
- Exposure
- Do not expose to the internet
What is port 21 used for?
Legacy file transfer to web hosts and network appliances.
Is it safe to expose port 21 to the internet?
Clear-text credentials and a long history of server bugs. Replace with SFTP or FTPS, or restrict by source address.
If port 21 seems closed or unreachable
- Check that the FTP control service is running and listening on port 21, not only on 127.0.0.1.
- Check the firewall on the host itself (Windows Defender Firewall, iptables, nftables, ufw) for a rule that allows TCP 21.
- If the host is behind a router, confirm the forwarding rule points to the correct internal address and that your internet provider does not use carrier-grade NAT.
- Test from outside your own network. A port can be open locally and blocked at the edge, or the other way round.
Using port 21 safely
Treat port 21 as an internal-only service. Reach it through a VPN or an SSH tunnel, restrict it by source address, and keep the software that listens on it patched.
Check whether port 21 is open on your host
The check connects from our server, so it shows what the internet can reach.
Open the port checker