{
    "title": "SSH and SFTP",
    "seo_title": "SSH and SFTP: definition, keys and security",
    "h1": "SSH and SFTP",
    "description": "SSH and SFTP: how the encrypted connection works, Ed25519 key authentication, sshd_config settings and how to use them with WordPress.",
    "lead": "SSH (Secure Shell) is a protocol that opens an encrypted session on a remote server so you can type commands there. SFTP (SSH File Transfer Protocol) uses the same encrypted channel to transfer and manage files. Together they replace Telnet and classic FTP, which sent credentials and data across the network in plain text.",
    "language": "en",
    "locale": "en-US",
    "type": "definition",
    "url": "https://www.wp-masquerade.com/glossary/ssh-sftp/",
    "canonical": "https://www.wp-masquerade.com/glossary/ssh-sftp/",
    "markdown": "https://www.wp-masquerade.com/glossary/ssh-sftp/index.md",
    "json": "https://www.wp-masquerade.com/glossary/ssh-sftp/index.json",
    "published": "2026-10-28T08:00:00+00:00",
    "modified": "2026-10-28T20:12:49+00:00",
    "site": {
        "name": "WP Masquerade",
        "url": "https://www.wp-masquerade.com/"
    },
    "translations": [
        {
            "language": "en",
            "hreflang": "en-US",
            "title": "SSH and SFTP",
            "url": "https://www.wp-masquerade.com/glossary/ssh-sftp/",
            "markdown": "https://www.wp-masquerade.com/glossary/ssh-sftp/index.md",
            "json": "https://www.wp-masquerade.com/glossary/ssh-sftp/index.json"
        },
        {
            "language": "fr",
            "hreflang": "fr-FR",
            "title": "SSH et SFTP",
            "url": "https://www.wp-masquerade.com/fr/definitions/ssh-sftp/",
            "markdown": "https://www.wp-masquerade.com/fr/definitions/ssh-sftp/index.md",
            "json": "https://www.wp-masquerade.com/fr/definitions/ssh-sftp/index.json"
        },
        {
            "language": "es",
            "hreflang": "es-ES",
            "title": "SSH y SFTP",
            "url": "https://www.wp-masquerade.com/es/glosario/ssh-sftp/",
            "markdown": "https://www.wp-masquerade.com/es/glosario/ssh-sftp/index.md",
            "json": "https://www.wp-masquerade.com/es/glosario/ssh-sftp/index.json"
        },
        {
            "language": "de",
            "hreflang": "de-DE",
            "title": "SSH und SFTP",
            "url": "https://www.wp-masquerade.com/de/glossar/ssh-sftp/",
            "markdown": "https://www.wp-masquerade.com/de/glossar/ssh-sftp/index.md",
            "json": "https://www.wp-masquerade.com/de/glossar/ssh-sftp/index.json"
        },
        {
            "language": "it",
            "hreflang": "it-IT",
            "title": "SSH e SFTP",
            "url": "https://www.wp-masquerade.com/it/glossario/ssh-sftp/",
            "markdown": "https://www.wp-masquerade.com/it/glossario/ssh-sftp/index.md",
            "json": "https://www.wp-masquerade.com/it/glossario/ssh-sftp/index.json"
        },
        {
            "language": "pt",
            "hreflang": "pt-BR",
            "title": "SSH e SFTP",
            "url": "https://www.wp-masquerade.com/pt/glossario/ssh-sftp/",
            "markdown": "https://www.wp-masquerade.com/pt/glossario/ssh-sftp/index.md",
            "json": "https://www.wp-masquerade.com/pt/glossario/ssh-sftp/index.json"
        },
        {
            "language": "nl",
            "hreflang": "nl-NL",
            "title": "SSH en SFTP",
            "url": "https://www.wp-masquerade.com/nl/woordenlijst/ssh-sftp/",
            "markdown": "https://www.wp-masquerade.com/nl/woordenlijst/ssh-sftp/index.md",
            "json": "https://www.wp-masquerade.com/nl/woordenlijst/ssh-sftp/index.json"
        }
    ],
    "headings": [
        {
            "level": 1,
            "text": "SSH and SFTP"
        },
        {
            "level": 2,
            "text": "SSH: the remote terminal"
        },
        {
            "level": 2,
            "text": "SFTP: files over the same channel"
        },
        {
            "level": 2,
            "text": "Key-based authentication"
        },
        {
            "level": 2,
            "text": "Hardening the SSH server"
        },
        {
            "level": 2,
            "text": "For WordPress"
        }
    ],
    "body": "To administer a server or edit a site's files, you need to connect to it remotely. For a long time, Telnet and FTP did that by sending the password in plain text, readable by anyone along the way. SSH encrypts the entire session and verifies the server's identity. The most widespread implementation, OpenSSH, ships on nearly every Linux server and is built into recent versions of Windows and macOS.\n\n## SSH: the remote terminal\n\nA command such as `ssh user@example.com` opens a terminal on the server, on port 22 by default. From there you run commands as if you were sitting at the machine: reading logs, counting files, or using [WP-CLI](https://www.wp-masquerade.com/glossary/wp-cli/) to manage WordPress. On the first connection, the client shows the fingerprint of the server's key: checking it protects you against an intercepted connection.\n\n## SFTP: files over the same channel\n\nDespite its name, SFTP has nothing to do with FTP: it's a subsystem of SSH. The usual clients (FileZilla, WinSCP, Cyberduck) support it, with the same username and the same port as SSH. Don't confuse it with FTPS, which adds TLS to classic FTP. On shared hosting, SFTP access is sometimes available without a shell, and it then runs inside the account's isolated environment, for example with [CageFS](https://www.wp-masquerade.com/glossary/cloudlinux-cagefs/).\n\n## Key-based authentication\n\nInstead of a password, SSH accepts a key pair. Since OpenSSH 9.5, `ssh-keygen` creates an Ed25519 key by default: the private key stays on your computer, and the public key is added to the account's `~/.ssh/authorized_keys` file on the server. When connecting, the client proves that it holds the private key without ever sending it.\n\n![Diagram of SSH key authentication. On your computer, ssh-keygen creates a key pair: the private key stays with you, protected by a passphrase. The public key is added to the account's ~/.ssh/authorized_keys file on the server. When you connect, the server asks for proof that only the holder of the private key can produce, checks it with the public key, then opens the SSH or SFTP session. No password is sent.](https://www.wp-masquerade.com/media/2026/10/authentification-cle-ssh-en.webp)\n\n*The private key never leaves your computer: the server only knows the public key.*\n\n```\nssh-keygen -t ed25519\nssh-copy-id user@example.com\n```\n\nProtect the private key with a passphrase: the ssh-keygen documentation recommends 10 to 30 characters that are hard to guess. A stolen key without a passphrase opens the server just like a password would.\n\n*Video: “How SSH password-less key based authentication work in 4 minutes (with example)” (Hussein Nasser)*\n\n## Hardening the SSH server\n\nOn a [VPS](https://www.wp-masquerade.com/glossary/vps/) or a dedicated server, the `/etc/ssh/sshd_config` file controls the service. By default, `PasswordAuthentication` is set to `yes` and `PermitRootLogin` to `prohibit-password` (root can log in, but not with a password). Once your keys are in place and tested from a second session:\n\n- set `PasswordAuthentication` to `no`, which makes [brute force](https://www.wp-masquerade.com/glossary/brute-force-attack/) attacks on SSH passwords pointless;\n- set `PermitRootLogin` to `no` and use a personal account with sudo;\n- restrict the allowed accounts and, if possible, the source addresses.\n\n## For WordPress\n\n- **Switch from FTP to SFTP** in your client and with your contractors, and delete unused FTP accounts.\n- **Give each person their own access**, with their own key, removed when the job is over.\n- **Check the permissions** of uploaded files: our article on [644 and 755 permissions](https://www.wp-masquerade.com/wordpress-file-permissions/) gives the right values.\n- **If you suspect a hack**, SSH gives you access to the diagnostic tools described in our guide [is my site hacked?](https://www.wp-masquerade.com/wordpress-site-hacked-signs/)\n\n## Related terms\n\n- [WP-CLI](https://www.wp-masquerade.com/glossary/wp-cli/)\n- [VPS (virtual private server)](https://www.wp-masquerade.com/glossary/vps/)\n- [Brute-force attack](https://www.wp-masquerade.com/glossary/brute-force-attack/)\n- [CloudLinux and CageFS](https://www.wp-masquerade.com/glossary/cloudlinux-cagefs/)\n- [Two-factor authentication (2FA)](https://www.wp-masquerade.com/glossary/two-factor-authentication/)\n\n\n## Sources\n\n- [OpenBSD manual : sshd_config(5)](https://man.openbsd.org/sshd_config)\n- [OpenBSD manual : ssh-keygen(1)](https://man.openbsd.org/ssh-keygen)\n- [OpenSSH 9.5 release notes](https://www.openssh.org/txt/release-9.5)",
    "definition": "SSH (Secure Shell) is a protocol that opens an encrypted session on a remote server so you can type commands there. SFTP (SSH File Transfer Protocol) uses the same encrypted channel to transfer and manage files. Together they replace Telnet and classic FTP, which sent credentials and data across the network in plain text.",
    "group": "Web hosting",
    "aka": [
        "Secure Shell",
        "SSH File Transfer Protocol",
        "SSH key",
        "OpenSSH",
        "ssh-keygen",
        "authorized_keys"
    ],
    "related": [
        {
            "title": "WP-CLI",
            "url": "https://www.wp-masquerade.com/glossary/wp-cli/",
            "markdown": "https://www.wp-masquerade.com/glossary/wp-cli/index.md"
        },
        {
            "title": "VPS (virtual private server)",
            "url": "https://www.wp-masquerade.com/glossary/vps/",
            "markdown": "https://www.wp-masquerade.com/glossary/vps/index.md"
        },
        {
            "title": "Brute-force attack",
            "url": "https://www.wp-masquerade.com/glossary/brute-force-attack/",
            "markdown": "https://www.wp-masquerade.com/glossary/brute-force-attack/index.md"
        },
        {
            "title": "CloudLinux and CageFS",
            "url": "https://www.wp-masquerade.com/glossary/cloudlinux-cagefs/",
            "markdown": "https://www.wp-masquerade.com/glossary/cloudlinux-cagefs/index.md"
        },
        {
            "title": "Two-factor authentication (2FA)",
            "url": "https://www.wp-masquerade.com/glossary/two-factor-authentication/",
            "markdown": "https://www.wp-masquerade.com/glossary/two-factor-authentication/index.md"
        }
    ],
    "sources": [
        {
            "title": "OpenBSD manual : sshd_config(5)",
            "url": "https://man.openbsd.org/sshd_config"
        },
        {
            "title": "OpenBSD manual : ssh-keygen(1)",
            "url": "https://man.openbsd.org/ssh-keygen"
        },
        {
            "title": "OpenSSH 9.5 release notes",
            "url": "https://www.openssh.org/txt/release-9.5"
        }
    ],
    "format": "application/json"
}