FTP vs SFTP vs FTPS on a Windows VPS: IIS FTP vs OpenSSH Setup and Security

Moving files to and from a Windows VPS is a solved problem, yet it is one of the most common support tickets. The confusion is usually terminology: FTP, FTPS, and SFTP are three different things, and Windows Server ships first-class support for all three. This article explains the differences with real port numbers and crypto details, then walks through both the IIS FTP role and OpenSSH-based SFTP so you can choose deliberately.

FTP, FTPS, and SFTP are not the same

Protocol	Default port	Encryption	Windows role
FTP	21	None (cleartext)	IIS FTP Server
FTPS (explicit)	21	TLS	IIS FTP Server + cert
SFTP	22	SSH transport	OpenSSH Server

Plain FTP sends credentials and data in the clear and should be considered retired. FTPS wraps the classic FTP conversation in TLS — useful when a partner’s tooling only speaks FTP. SFTP is an entirely different protocol tunneled over SSH, has a single port, and works through NAT far more cleanly. If you control both ends, SFTP is the better default.

Option A: IIS FTP with explicit TLS

Install the role with Install-WindowsFeature Web-Ftp-Server -IncludeManagementTools. Then create the site and bind a certificate:

New-WebFtpSite -Name "CorpFTP" -Port 21 -PhysicalPath "D:\ftp\corp"
Set-ItemProperty "IIS:\Sites\CorpFTP" -Name ftpServer.security.ssl.controlChannelPolicy -Value 2
Set-ItemProperty "IIS:\Sites\CorpFTP" -Name ftpServer.security.ssl.dataChannelPolicy -Value 2
Set-ItemProperty "IIS:\Sites\CorpFTP" -Name ftpServer.security.authentication.basicAuthentication.enabled -Value $true

Setting both control and data channel policy to 2 forces TLS on every connection, which also means you must open a passive port range in the firewall. Configure ftpServer.security.ssl.serverCertHash with your certificate thumbprint. A common failure is forgetting the passive range, resulting in successful login but failed directory listing.

Option B: OpenSSH SFTP

Windows Server includes an OpenSSH Server capability. Install it, start the service, and SFTP is available on port 22 using local Windows accounts or an authorized_keys file.

Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0
Start-Service sshd
Set-Service -Name sshd -StartupType Automatic
New-NetFirewallRule -Name sshd -DisplayName 'OpenSSH Server' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22

To restrict key-based login to SFTP only, edit sshd_config and set the internal-sftp subsystem, then restart the service. Key authentication removes password brute-force risk entirely, which matters because SSH is scanned constantly on public IPs.

Which to choose

• Automated app-to-app transfers on Windows: IIS FTPS, because it integrates with IIS users and quotas.
• Admins and CI/CD pipelines: SFTP over OpenSSH with keys, single port, scriptable from any platform.
• Legacy partner requirement: FTPS only if plain FTP is impossible; never enable cleartext FTP on a public IP.

Hardening checklist

Whichever path you take: disable anonymous access, scope the firewall rule to known source IPs where possible, put the file root on a separate volume or directory with explicit ACLs, and enable transfer logging. On the IIS side, per-site logging captures uploads; on the SSH side, the Windows event log and sshd log record sessions. Test fail2ban-equivalent protection by rate-limiting at the firewall, since there is no native equivalent on Windows.

Passive mode and NAT on cloud VPS

FTP uses a separate data connection, and in passive mode the server tells the client which port to open. On a VPS sitting behind a provider NAT or a firewall, that advertised address is often the private IP rather than the public one, which produces the classic “connects, authenticates, then hangs on LIST” symptom. The fix is to configure the external IP and a fixed passive port range in IIS:

Set-ItemProperty "IIS:\Sites\CorpFTP" -Name ftpServer.security.dataChannelPortRange -Value "50000-50100"
netsh advfirewall firewall add rule name="FTP Passive" dir=in action=allow protocol=TCP localport=50000-50100

If the provider does port forwarding at the edge, the public IP must be set in the site’s external address field as well, otherwise clients keep receiving the internal IP in the PASV response. SFTP has none of this complexity because everything flows over a single port, which is one more reason it is the better default.

Permissions and isolation

Both stacks support user isolation. In IIS FTP, ftpServer.userIsolation.mode can be set to physical or virtual directory isolation so each user lands in their own folder with no visibility into others — essential for multi-tenant file drops. For SFTP, the cleanest approach is to create a local group, give it read or write ACLs on one directory, and use AuthorizedKeysFile per user so keys are independent. Never grant a file-transfer account membership in Administrators; the protocol is a data port, not an admin channel.

Performance and large transfers

For large files, FTPS and SFTP both add crypto overhead, but on modern VPS CPUs with AES-NI this is negligible compared to network throughput. The real limiters are TCP window sizing on high-latency links and disk write speed. If you routinely move multi-gigabyte files, prefer SFTP with a client that parallelizes streams, and ensure the data volume has enough IOPS. Small files are dominated by per-request round trips, so batching them into an archive before transfer is usually faster than any protocol tweak.

Monitoring transfers

Enable logging on whichever stack you use and review it periodically. Failed authentication bursts against FTP or SSH are one of the earliest signals of a targeted attempt, and the pattern — many usernames from one source — is trivial to alert on. Combine that with source-IP allow-listing for fixed partners and you eliminate the majority of noise before it reaches an alert threshold.

A Windows VPS is an excellent file-transfer hub because both stacks are one role away. If you are provisioning a new box for this, see our Windows VPS plans to pick a configuration with enough disk for your data set, and review our hosting documentation for the recommended firewall baselines.