FTP Anonymous Login Checker
Check whether an FTP server accepts anonymous logins - a common misconfiguration and potential security risk.
What is anonymous FTP?
Anonymous FTP allows users to connect to an FTP server without a personal account, using the username anonymous and any string (typically an email address) as the password. It was historically used to distribute public software but is now considered a security risk on servers that host sensitive data.
Plenty of servers still allow it on purpose - Linux distribution mirrors, firmware download servers, and public archives all serve files this way. The problem is the servers that allow it by accident: a default configuration left enabled, a test setup promoted to production, or an anonymous directory that was never meant to hold customer data. That's the gap this check finds.
How this check works
The tool connects to your server on the given port, attempts a real login with the username anonymous, and reports the server's actual response - including the greeting banner when access is granted. Nothing is downloaded or uploaded; it's the same handshake an attacker's scanner would try, run once, from your browser.
Why check for anonymous access?
- Unintended anonymous access can expose private files to the public internet.
- Attackers use anonymous FTP to upload malware or use the server as a staging point.
- Many compliance frameworks (PCI-DSS, HIPAA) require anonymous FTP to be disabled.
While you're auditing the server: verify credentials and reachability with the FTP Connection Tester, and see what software the server announces to the world with the FTP Server Banner Grabber. And when the audit turns into actual file work, FTPie is a modern free FTP client for Windows with FTPS and SFTP built in.
Common questions
The username is anonymous, and the password is traditionally your email address - though most servers accept any string. Many servers also accept the shorter username ftp. If either login succeeds, the server allows anonymous access.
No. Public download mirrors and software archives use anonymous FTP deliberately, and read-only access to genuinely public files is fine. It becomes a risk when it is enabled unintentionally, when the accessible directories contain private data, or when anonymous users can upload - writable anonymous FTP is a classic staging ground for malware distribution.
On vsftpd set anonymous_enable=NO in vsftpd.conf and restart the service. On ProFTPD remove or comment the Anonymous section of the configuration. On FileZilla Server delete the anonymous user account. On IIS disable Anonymous Authentication for the FTP site. Then re-run this checker to confirm the server now denies the anonymous login.