Configure WinSCP for SFTP only, do not knock FTP port.
I see that WinSCP checks if FTP is available when SFTP fails. Can WinSCP be configured to never try FTP, do not look/check/try/knock, only use SFTP. If SFTP fails, game over. Do not try anything else for any reason.
Failed to connect to aaa.bbb.ccc.ddd: Network error: Connection timed out Knocking FTP port. FTP port opened, will suggest using FTP protocol. Script: Network error: Connection to "example.com" timed out. The server rejected SFTP connection, but it listens for FTP connections. Did you want to use FTP protocol instead of SFTP? Prefer using encryption.