I use FTPS with vsftpd to update my WordPress plugins. This means that the wordpress files don’t need to be writeable by the webserver user, which adds another layer of protection and separation. I make FTPS available to localhost only, and force SSL encryption end-to-end.
This is a companion discussion topic for the original entry at https://www.funkypenguin.co.nz/note/solving-vsftpds-unsupported-record-version-unknown-48-48-error/