Total Commander error 29 and FTP problems: how to fix them

Below I cover where error 29 comes from, the quick fix in Total Commander, firewall configuration and the migration you should not skip: moving to the secure SFTP protocol with SSH keys.

#Why Total Commander reports error 29: active (PORT) vs passive (PASV) mode

The classic FTP protocol (RFC 959) uses two separate communication channels:

1. Control channel (control connection): usually on server port 21, used to send commands (USER, PASS, LIST, RETR, STOR) and receive response codes.
2. Data channel (data connection): a separate TCP connection that carries directory listings and the file contents themselves.

The difference between active and passive mode decides which side opens the connection for the data channel:

ACTIVE MODE (PORT) - Prone to error 29:
Client:21   ---> Server:21      [Command channel]
Client      <--- Server:20      [Data channel: Server connects to Client port]
                                 ^ NAT router / Firewall blocks the incoming packet!

PASSIVE MODE (PASV) - The correct solution:
Client:21   ---> Server:21      [Command channel]
Client      ---> Server:50234   [Data channel: Client connects to Server port]
                                 ^ Outgoing traffic through NAT is allowed!

#How error 29 happens

When passive mode is switched off in Total Commander, the program runs in active mode. After authentication the client sends the server the command PORT h1,h2,h3,h4,p1,p2, giving its local IP address and a random port on which it listens for data from the server.

In modern home and office networks the computer sits behind a NAT router. The client gives the server its private IP address (for example 192.168.1.50), which a server on the internet cannot reach directly. Even if the router supports FTP ALG (Application Layer Gateway) and rewrites the address to the public one, the local Windows firewall or the router’s stateful filter will reject the unsolicited incoming connection from server port 20. Once the timeout on the data socket runs out, Total Commander returns error 29.

#How to fix error 29 in Total Commander step by step

In most cases the fix is to force passive mode for the connection profile in question.

#Step 1: Enable passive mode (PASV)

1. Start Total Commander and press Ctrl+F (or choose Net > FTP Connect from the main menu).
2. In the list of defined connections, select the server that is causing problems and click Edit.
3. In the configuration window, find the checkbox Use passive mode for transfers (like a WWW browser).
4. Tick this option.
5. Click OK, then reconnect to the server.

In passive mode the client sends the server the PASV command. In response the server opens a random port from its defined pool of passive ports and sends back the port number. Total Commander then opens an outgoing connection to that port itself. Because routers and stateful firewalls let outgoing traffic through by default, the data transfer goes ahead without obstacles.

#Step 2: Check the Windows Defender firewall

If the error persists even with passive mode on, the system firewall may be blocking the Total Commander process itself:

1. Open Control Panel > System and Security > Windows Defender Firewall.
2. Choose Allow an app or feature through Windows Defender Firewall.
3. Check whether TOTALCMD.EXE (or TOTALCMD64.EXE) is on the list.
4. Make sure the boxes for Private and Public networks are ticked.
5. If the program is not on the list, click Allow another app and point to the Total Commander install path (by default C:\totalcmd\totalcmd64.exe).

#Step 3: Server configuration (for VPS and dedicated server administrators)

If you run your own FTP server (for example vsftpd or ProFTPD on Linux) and no client can connect in PASV mode, the problem lies in the passive port pool configuration on the server.

In /etc/vsftpd.conf, make sure the port range and the external IP address are defined:

pasv_enable=YES
pasv_min_port=50000
pasv_max_port=50100
pasv_address=YOUR_PUBLIC_SERVER_IP

Then open that range in the server firewall (for example UFW):

sudo ufw allow 21/tcp
sudo ufw allow 50000:50100/tcp
sudo systemctl restart vsftpd

#How to check the Total Commander FTP log for the cause of error 29

Before you change firewall rules, check the log for the command where the session stops. Total Commander shows the session in a log window on the FTP toolbar, and the LogFile key in the [General] section of wcx_ftp.ini writes it to a file, for example LogFile=c:\Path\Log.txt (TotalcmdWiki, wcx_ftp.ini). Logging to a file has existed since version 3.51 from 1998 (Total Commander version history).

Look for two patterns defined in RFC 959:

• After the PORT command the server replies 200, but LIST or RETR then returns 425 Can't open data connection or runs into a timeout. That is active mode blocked by NAT or a firewall.
• After the PASV command the server replies 227 Entering Passive Mode (h1,h2,h3,h4,p1,p2). The first four numbers are the address the client has to connect to. If that is a private address, 127.0.0.1 or 0.0.0.0, the fault is on the server: it lacks a setting such as pasv_address from step 3.

Newer Total Commander versions work around some of these faults on their own. According to the version history, since July 2020 the program connects to servers that answer PASV with the address 0.0.0.0, and since March 2025 it handles servers that report 127.0.0.1 instead of their real address. In September 2016 the endless retries were removed for the case where both PASV and PORT fail because of a misconfigured server. If the log shows an odd address in the 227 reply and the installed version is old, updating the program is often faster than waiting for the server administrator.

To make every new connection use passive mode from the start, set pasvmode=1 in the [default] section. For connections that a router drops often, the wiki documents TcpKeepAlive=1 in the [General] section, which turns on TCP keep-alive for all connections.

#Why classic FTP is a critical security risk

Fixing error 29 gets your connection back, but staying on FTP poses serious threats to the integrity of your websites.

RISKS OF THE UNENCRYPTED FTP PROTOCOL:
+-------------------------------------------------------------------+
| 1. Credentials sent in plaintext (port 21)                       |
|    - Login and password visible to every intermediate node        |
+-------------------------------------------------------------------+
| 2. wcx_ftp.ini file exposed to infostealers                      |
|    - Weak local encryption in Total Commander                    |
+-------------------------------------------------------------------+
| 3. No atomic file transfers                                      |
|    - A dropped session breaks PHP files and causes White Screen   |
+-------------------------------------------------------------------+
| 4. No checksums or integrity verification                         |
|    - Risk of silent corruption of binary files                   |
+-------------------------------------------------------------------+

#1. Passwords sent as clear text

FTP encrypts neither the control channel nor the data channel. Every packet passing through the local network, your internet provider or transit nodes can be captured with a simple network sniffer (for example Wireshark). Your access password to the production server travels as plain text.

#2. Credential theft from wcx_ftp.ini

Total Commander stores FTP session configuration in the wcx_ftp.ini file. Without a master password, the passwords saved in that file are only disguised, not encrypted. The weakness is documented as CVE-2005-4066, and reading the file is automated: the Metasploit framework ships the module Windows Gather Total Commander Saved Password Extraction, which finds saved connections in wcx_ftp.ini and extracts their passwords (Rapid7).

#3. Risk of outages and error 500 (White Screen of Death)

When you upload an updated theme or plugin file (functions.php, class-core.php), an FTP transfer overwrites the file block by block. If the connection drops halfway through, the server is left with incomplete, broken PHP code, which takes the whole site down at once with a fatal 500 error.

#How to protect FTP passwords in Total Commander with a master password

TotalcmdWiki describes the password field in the connection sections of wcx_ftp.ini as disguised, not encrypted (TotalcmdWiki). The NVD lists the same problem as CVE-2005-4066: Total Commander 6.53 stored FTP usernames and passwords with weak encryption that a local user can reverse.

The vendor’s answer is the master password. The version history records work on it in February 2008, and the feature shipped in version 7.50, released in September 2009. The history describes the mechanism as AES encryption with the master password (version history).

Turning it on takes a minute:

1. Press Ctrl+F, select the connection and click Edit.
2. Tick the Encrypt with master password checkbox.
3. Set the master password. The program asks for it once per session, on the first connection to a server whose password it protects.

A few behaviours matter before you roll this out to a team. Since June 2022 Total Commander clears the passwords of active FTP connections when the window is minimised or the screen saver starts, the same way it clears the master password. The KeepMasterPassword key in the [General] section keeps the master password when the program is minimised (1), when the screen saver starts (2) or in both cases (3). Since June 2020 the program can hold the master password through Windows Hello until Total Commander closes, so reconnecting takes a fingerprint, face or PIN.

The master password protects the file on disk, but it does not change the protocol. Username and password still travel in clear text over port 21 if the connection uses plain FTP.

#How to connect over FTPS in Total Commander

The built-in FTP client in Total Commander supports FTPS, which is FTP over SSL/TLS. It is the middle step for servers that offer no SSH access but do offer encrypted FTP.

Since September 2016 the program opens FTPS connections without the OpenSSL libraries, through the Windows sChannel functions in Secur32.dll. The same change added TLS 1.1 and TLS 1.2 and records the negotiated protocol in the connection log. When you tick the SSL/TLS option in the connection dialog, the program ticks passive mode as well, because FTPS does not work in active mode (version history). On the client side, error 29 therefore goes away with the move to FTPS. On the server side the passive port range still has to be open in the firewall, as in step 3.

Two options for stricter environments:

• Client certificate: since April 2018 Total Commander can use client certificates from the Windows certificate store for FTPS. This works only through sChannel, not OpenSSL.
• OpenSSL 3: since March 2022 the program accepts the OpenSSL 3.0 libraries from curl.se. The files libssl-3.dll and libcrypto-3.dll (for 64-bit libssl-3-x64.dll and libcrypto-3-x64.dll) go into the program directory, not the 64 subdirectory. When both methods are available, the PreferOpenSSL key in wcx_ftp.ini chooses between sChannel and OpenSSL.

FTPS keeps two channels and the passive port range on the firewall. SFTP, covered next, uses a single connection on port 22, so on servers with SSH access it is simpler to maintain.

#How to use the SFTP plugin in Total Commander

If Total Commander’s two-panel interface is your main working tool, you do not have to give it up. Just replace insecure FTP with the fully encrypted SFTP (SSH File Transfer Protocol).

#How to install and configure the SFTP plugin

1. Download the official SFTP plugin for Total Commander from ghisler.com (author: Christian Ghisler).
2. Open the downloaded .zip archive directly in Total Commander. The program recognises the plugin and asks: Do you want to install this plugin? Choose Yes.
3. Go to Network Neighborhood (the drive selection button: \).
4. Open the Secure FTP folder.
5. Press F7 to create a new connection.
6. Enter the connection name, the host name (IP address or domain), the port (22 by default) and the user name.

#How to set up SSH key authentication

Instead of typing a password, set up authentication with a cryptographic key:

1. In the connection settings, point to the private key file in OpenSSH format. The plugin readme states that keys given directly must use this format (SFTP plugin readme).
2. The plugin accepts a key in PuTTY format (.ppk) through Pageant. Pageant can start automatically if you place a shortcut named pageant.lnk in the plugin directory that points to pageant.exe with the key file name as a parameter.
3. You can also convert a .ppk key in puttygen: load the key, then choose Conversions > Export OpenSSH key. The readme warns against the Save public key button, because it creates a public key in a format OpenSSH does not accept. Copy the public key from the field Public key for pasting into OpenSSH authorized_keys file instead.
4. An SFTP connection encrypts both the login and the transferred files, so the password never crosses the network in clear text.

Plugin version 3.10 from July 2026 runs on Windows Vista through 11 with the built-in sChannel library and needs no extra DLLs. It also supports SCP-only servers, connections through an HTTP proxy with the CONNECT command, and keep-alive. Preferred algorithms (key exchange, host key, cipher, MAC, compression) can be set per connection in sftpplug.ini with the keys prefmethod0 to prefmethod7, for example prefmethod0=curve25519-sha256.

#How FTP and SFTP file transfer protocols compare

The table below sets out the technical parameters and security level of each method of transferring files to a server:

#How to move from FTP to CI/CD deployments

In modern production environments, manually uploading files through a file manager gives way to an automated deployment process.

#How atomic zero-downtime deployment works

Instead of changing files directly in the public_html directory, an atomic deployment prepares the new version in a separate releases directory and then switches the symbolic link in an instant:

/var/www/mysite/
|-- current -> /var/www/mysite/releases/2026-09-21-1200/   [Symbolic link]
|-- releases/
|   |-- 2026-09-20-0930/  [Previous release]
|   `-- 2026-09-21-1200/  [New, fully built release]
`-- shared/
    |-- wp-config.php     [Shared configuration]
    `-- wp-content/uploads/ [Shared media]

Benefits of this approach:

• No downtime: switching the symbolic link with ln -nfs takes a few milliseconds.
• Safety: if installing Composer dependencies or building assets fails, the symlink is not switched and the site keeps running normally on the previous release.
• Instant rollback: going back to the previous version after spotting a bug takes a single command that points the symlink back.

Automating deployments with Git removes the need to open FTP ports, protects source code from accidental overwrites and gives you a full history of every change made.

#What are the most common questions about FTP error 29

Fixing file transfer problems and dropping the outdated FTP protocol in favour of secure deployment procedures is a basic part of keeping infrastructure stable. If you plan to tidy up your server environment or set up a secure CI/CD pipeline, see my WordPress developer services.