Ftp vs Webdav
FTP is a 1971 file-transfer protocol with a separate control and data channel; WebDAV extends HTTP with verbs for remote authoring. The verdict for modern file transfer and remote storage.
The short answer
Webdav over Ftp for most cases. WebDAV rides HTTP, so it works through firewalls, NAT, and TLS without the dual-channel circus FTP forces on you.
- Pick Ftp if stuck talking to legacy hardware, an ISP shared-hosting box, or a vendor appliance that only speaks FTP — and you wrap it in FTPS or SFTP, never plain
- Pick Webdav if want remote file authoring over HTTPS that survives firewalls, NAT, and corporate proxies — collaborative editing, calendar/contact sync, or mounting a drive over the web
- Also consider: Neither is your real answer if you just need secure file movement: reach for SFTP (SSH) or object storage like S3. FTP and WebDAV are both showing their age.
— Nice Pick, opinionated tool recommendations
The Architecture Problem
FTP's original sin is two channels: a control connection on port 21 and a separate data connection that flips between active and passive mode depending on who blinks first. The result is a protocol that fights every firewall, NAT router, and proxy ever built. Network admins despise it for a reason — passive-mode port ranges are a security nightmare and active mode is dead on arrival behind NAT. WebDAV, by contrast, is just HTTP with extra verbs (PROPFIND, MKCOL, LOCK, MOVE). One connection, one well-understood port, full TLS for free. Everything that already routes web traffic routes WebDAV. FTP makes you configure your network around the protocol; WebDAV slots into infrastructure you already run. That single design difference decides most of this matchup before features even enter the conversation.
Security: FTP Is Naked By Default
Plain FTP ships credentials and file contents in cleartext. In 2026 that is malpractice. Yes, FTPS exists, but it bolts TLS onto that miserable dual-channel design, and the data connection's encryption negotiation breaks NAT helpers and inspection middleware constantly. Half the FTPS deployments I've seen silently fall back or misconfigure the data channel. WebDAV inherits HTTPS wholesale — TLS, HSTS, cert pinning, the entire mature web security stack, on one channel, with no special handling. Auth is also saner: WebDAV does Basic over TLS, Digest, or whatever your reverse proxy bolts on (OAuth, mTLS, SSO). FTP's auth model is a username and password and a prayer. If your threat model includes 'someone on the network,' FTP loses outright and FTPS loses on operational complexity. WebDAV's security story is boring, and boring is exactly what you want.
Tooling, Ecosystem, and Reality
Here's where FTP claws back points: ubiquity. Every shared host, every ancient NAS, every router firmware speaks FTP. FileZilla is muscle memory for a generation of developers. WebDAV's client support is patchy and weird — Windows' built-in 'Map Network Drive' WebDAV client is famously flaky, macOS Finder mounts it but chokes on large files, and Linux davfs2 is fine until it isn't. WebDAV servers also vary wildly: Nextcloud and Apache mod_dav are solid, while bargain hosts barely implement the spec. So FTP wins on 'it's already there,' and that inertia is real money saved on legacy systems. But ubiquity isn't quality — it's just age. New systems shouldn't be born speaking FTP, and most aren't. WebDAV at least composes with the modern web; FTP composes with nostalgia.
The Honest Bottom Line
Be clear-eyed: in 2026 the actual winner for most file-transfer jobs is neither of these. SFTP (file transfer over SSH) eats FTP's lunch — one encrypted channel, key-based auth, firewall-friendly, and it's what people usually mean when they sloppily say 'FTP.' For storage and distribution, object stores like S3 and their presigned URLs have replaced both. So this is a fight between two aging protocols, and within that narrow ring WebDAV is the less painful choice because it's HTTP all the way down. Pick FTP only when something external forces your hand — a vendor box, a legacy contract, a host that offers nothing else — and even then wrap it in TLS or switch to SFTP if you can. WebDAV is the default; FTP is the exception you tolerate, not the tool you choose.
Quick Comparison
| Factor | Ftp | Webdav |
|---|---|---|
| Firewall / NAT friendliness | Dual-channel, breaks NAT and firewalls constantly | Single HTTP connection, routes anywhere web traffic does |
| Default security | Cleartext by default; FTPS bolts TLS onto a broken design | Inherits full HTTPS/TLS stack on one channel |
| Client ubiquity / legacy support | Everywhere — every host, NAS, and router speaks it | Patchy; native OS clients are flaky |
| Modern web composability | Standalone protocol, integrates with nothing new | Just HTTP verbs; works with proxies, SSO, reverse proxies |
| Right tool for the job today | Superseded by SFTP for transfer | Superseded by S3/object storage for distribution |
The Verdict
Use Ftp if: You're stuck talking to legacy hardware, an ISP shared-hosting box, or a vendor appliance that only speaks FTP — and you wrap it in FTPS or SFTP, never plain.
Use Webdav if: You want remote file authoring over HTTPS that survives firewalls, NAT, and corporate proxies — collaborative editing, calendar/contact sync, or mounting a drive over the web.
Consider: Neither is your real answer if you just need secure file movement: reach for SFTP (SSH) or object storage like S3. FTP and WebDAV are both showing their age.
WebDAV rides HTTP, so it works through firewalls, NAT, and TLS without the dual-channel circus FTP forces on you. Unless a crusty legacy box demands FTP, WebDAV is the correct default.
Related Comparisons
Disagree? nice@nicepick.dev