An FTP or FTPS server at another site is a simple off-site target for SQL Server backups. SQL Server cannot write to FTP itself, so you back up locally and then transfer the files on a schedule. This guide uses WinSCP's free command-line client, which handles FTP, FTPS and SFTP.
FTP, FTPS or SFTP?
| Protocol | Encryption | Use it? |
|---|---|---|
| FTP | None. The password and data cross the network in plain text. | Only inside a trusted network or VPN. |
| FTPS (FTP over TLS) | Encrypted login and data | Yes. Most hosting control panels support it. |
| SFTP (over SSH) | Encrypted login and data | Yes, where the server offers SSH. |
Step 1: create a dedicated FTP account
Create an account that can only reach the backup folder. If the backup machine is ever compromised, the attacker gets that folder and nothing else.
Step 2: install WinSCP and test a connection
Install WinSCP, connect once in the graphical client to accept the server's certificate or host key, and note the exact fingerprint. The command-line client is WinSCP.com in the install folder.
Step 3: upload new backups from a script
ftpes:// means FTP with explicit TLS (the common FTPS mode). Use sftp:// for SFTP. The -neweronly switch skips files that are already on the server.
@echo off
set WINSCP="C:\Program Files (x86)\WinSCP\WinSCP.com"
%WINSCP% /ini=nul /log="D:\SQLBackups\logs\ftp.log" /command ^
"open ftpes://backupuser:YOUR_PASSWORD@ftp.example.com/ -certificate=""xx:xx:xx...""" ^
"put -neweronly D:\SQLBackups\*.bak /sqlbackups/" ^
"exit"
if errorlevel 1 (
echo %DATE% %TIME% FTP UPLOAD FAILED >> "D:\SQLBackups\logs\backup.log"
exit /b 1
)Adjust the WinSCP path to where it is installed, and paste the certificate fingerprint you noted in step 2. Call this batch file at the end of your backup script, after the backup succeeds.
A password in a batch file can be read by anyone who can read the file. At minimum, restrict the script folder's permissions to the backup account and administrators. Better, save the session in WinSCP and reference it by name, or use SFTP with a key file.
Step 4: make sure files arrive intact
- Binary mode only. An ASCII-mode transfer corrupts
.bakfiles, and restores then fail with error 3241. WinSCP uses binary mode by default. Other clients may not. - Compare sizes after transfer. Check the remote file size matches the local one. WinSCP logs each transfer, so review
ftp.logafter the first runs. - Test a restore from a downloaded copy once, so you know the whole path works.
Step 5: clean up old files on the server
The FTP folder needs its own retention, or it fills up. WinSCP can delete remote files older than a set age:
"rm /sqlbackups/*.bak<30D"The <30D mask matches files older than 30 days. Test it on a copy folder first.
When the transfer fails
Most FTP failures are temporary: a dropped connection, a busy server, a full remote disk. A simple improvement is to retry: run the upload again after a few minutes if the first attempt returns an error. Also make sure the failure is visible to someone, not just written to a log. See SQL Server backup failed for a wider checklist.
FTP/FTPS backup with Velocity
Velocity has FTP/FTPS as a built-in destination. Add the server once, then send any SQL Server or file backup job to it, alongside a local copy. Failed transfers retry automatically on a delay sequence, and you can get an email after each backup.