How to Improve the Security of Your Wing FTP Server

Wing FTP Server is a powerful, cross-platform FTP server solution that supports multiple transfer protocols. It can be deployed on both internet and local network, but like any network service, it needs proper hardening. This guide covers six practical steps to improve the server security.

1. Use Encrypted Protocols

Use HTTPS, FTPS, or SFTP instead of plain FTP/HTTP. Plain FTP/HTTP sends credentials and data in cleartext, you should disable the protocols "FTP" and "HTTP" under user account settings.

2. Restrict Access by IP

If your clients use fixed IP ranges, allow only those IP addresses. Go to "Domain > Settings > IP Access" and add "Allowed" rules for trusted ranges. If you add only "Allowed" rules, all other IPs will be denied. This is a strong first line of defense.

3. Enable Anti-Hammer

To prevent brute-force attacks, just enable the option "Domain > Settings > General Settings > Password & Security > Enable Anti-hammer", set a failed-attempt limit and ban duration.

4. Password Salting

For new installs, it is recommended to enable password salting before creating users. Go to "Domain > Settings > General Settings > Password & Security", check the option "Enable password salting and specify a salt string" and use a unique salt string. Passwords are then stored as SHA256(password + salt), which blocks rainbow-table attacks.

5. Force Periodic Password Changes

Regular password rotation limits the damage if credentials are leaked. You may enable the option "Need to change the password on the first logon" under "Domain > Settings > General Settings > Password & Security", then schedule a Lua script to force password changes periodically like this: https://bbs.wftpserver.com/viewtopic.php?t=4112
You can adjust the parameters in the Lua script to match your password policy.

6. Upgrade to v8.2.5 or Later

All the versions prior to 8.2.5 contain known critical vulnerabilities, please upgrade to v8.2.5 or later as soon as possible, the latest version of installation files and release notes can be found on our website: https://www.wftpserver.com/wftpserver.htm

Summary

Securing WingFTP's deployment is not about a single setting but about layering multiple defenses. Encrypted protocols, IP access rules, Anti-hammer, password salting, password rotation, and timely updates. Together, they greatly reduce the risk of unauthorized access and data loss.