Wing FTP Server is a self-hosted file-transfer service for organizations or individuals who want other people to reach selected folders through FTP, FTPS, SFTP, HTTP, or HTTPS. It runs as a server process rather than as a desktop download client. An administrator creates a domain, assigns accounts, maps real storage folders to visible paths, and decides which actions each account may perform.
Domains divide access
A domain is an independent service boundary inside Wing FTP Server. It has its own listeners, authentication settings, users, groups, certificates, limits, and file locations. Several domains can therefore share one machine without sharing the same account list or root directory.
Each user receives a home directory, while virtual directories can expose other folders under aliases. Permissions are granular: reading a file, writing a new one, appending an interrupted upload, deleting, listing, creating directories, and renaming are separate choices. This avoids granting full write access merely because someone needs to upload into one destination.
Groups reduce repeated setup when many accounts need the same rules. A user can inherit rights from more than one group, and the order of those groups matters. A user-level setting can override inherited behavior, so an unexpected denial may come from the account itself rather than the first group shown in the panel.
Passive ports need routing
FTP uses one connection for commands and another for file data. In passive mode, Wing FTP Server chooses the data port from a range configured for the domain. The operating-system firewall must permit that range. If the server sits behind a router, the router must forward the same ports to the server.
The PASV response also needs an address that an outside client can reach. Advertising a private LAN address works only for clients on that LAN. A public fixed address can be entered directly, while a changing connection needs the server’s dynamic-address handling. A login can succeed while directory listings and transfers time out when this part is wrong, which makes passive routing a common source of misleading failures.
Two FTP services on one public address should not compete for the same passive range. Giving each service a distinct range makes firewall rules and connection failures easier to trace.
TLS differs from SFTP
FTPS and HTTPS protect their sessions with a TLS certificate. Wing FTP Server’s certificate manager expects PEM certificate and private-key material. A certificate delivered as a PFX archive needs conversion before import. The private key must stay restricted because anyone who obtains it can impersonate the service until the certificate changes.
SFTP is a different protocol that runs through SSH. It uses an SSH host key, not the FTPS certificate. Configuring a trusted web certificate does not give SFTP the same identity automatically. Clients may warn when the host key changes, which is expected after an intentional replacement but also requires verification before acceptance.
Accounts need boundaries
Authentication can remain local or connect to directory systems, with mappings that give an external identity the permissions of a local account. The mapping must point to the intended local profile; otherwise a successful directory login can land in the wrong home path or inherit broader rights than planned.
Administrator accounts deserve separate limits. Wing FTP Server can restrict an administrator to selected domains, a base folder, or a set of source IP addresses. Two-factor authentication protects the panel, but losing the primary administrator’s authenticator requires a recovery procedure through the installer rather than a simple sign-in link.
Logs explain failures
Connection and transfer logs record authentication, commands, paths, and protocol errors. They help distinguish an incorrect password from a permission denial or a failed passive data connection. Logging also consumes storage, so retention and rotation need attention on an active server.
A successful test should cover more than opening the administration page. Test one restricted account through every enabled protocol, upload and resume a file, list a virtual directory, and confirm that forbidden deletion or renaming really fails. That small matrix catches certificate, firewall, path, and permission mistakes before public users encounter them.
