Recommended Free Tools
To get SFTP access to a WordPress multisite, ask the hosting provider or server administrator to create an SFTP account for the correct production or staging environment. They must provide the server host, SSH port, username, and either a password or SSH key. A normal WordPress role—administrator, editor, or network administrator—does not automatically create or reveal SFTP credentials.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
Before connecting, confirm whether the account opens the entire multisite installation or is restricted to a directory such as wp-content/uploads. SFTP is encrypted file transfer over SSH, but the account can still change files and settings. Treat it as administrative access, use the smallest practical scope, and check ownership and permissions before editing.
As an Amazon Associate I earn from qualifying purchases.
What SFTP access means on a WordPress multisite
WordPress multisite is one WordPress installation that serves multiple sites in a network. The sites share the WordPress core files, themes, plugins, and configuration, even though each site has its own dashboard settings and content. SFTP operates at the server filesystem level, not at the WordPress dashboard level.
That distinction explains why a user can be a network administrator in WordPress and still have no SFTP login. Dashboard roles are stored in WordPress and govern application features. An SFTP account is created by the host or server administrator and is governed by operating-system users, SSH settings, directory ownership, and path restrictions.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
The WordPress hardening guidance says, “When connecting to your server you should use SFTP encryption if your web host provides it.” SFTP encrypts the connection, including the login and file transfers. It does not make an over-privileged account safe: a user who can write to the installation may replace plugins, alter themes, edit configuration, or remove files.
Who can issue the credentials
Managed hosting
On managed hosting, open the control panel’s SFTP or SSH-user area, if available, or contact support. Tell the provider:
- the exact multisite installation and domain,
- whether you need production or staging,
- the directory or directories required for the task,
- the preferred authentication method (password or SSH key), and
- when temporary access should expire.
Some hosts create separate users for production and staging. Do not assume that a username working on staging also reaches production; verify the environment in the host panel and in the directory you see after login.
Self-managed VPS or server
If your organization controls the server, the system administrator must create an SSH account, install its public key or set a password, and restrict the account’s home directory or chroot path as appropriate. They also need to ensure that the account can read or write the directories required by the job without exposing unrelated sites or system files.
Do not create a new account by copying a full-privilege administrator login. A separate, named account makes auditing and revocation possible. If a contractor needs access, issue an account for that person or team rather than sharing the server owner’s credentials.
Request the narrowest useful scope
Ask for path restrictions instead of full access to the server root. The right scope depends on the task:
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →| Task | Usually required path | Risk and notes |
|---|---|---|
| Upload media for one site | That site’s uploads directory, often under wp-content/uploads |
Cannot edit themes, plugins, or core files; exact per-site path varies by installation. |
| Edit a theme | The active theme directory under wp-content/themes |
Changes affect the site or network using that theme; a child theme may be safer. |
| Install or update a plugin | wp-content/plugins |
Plugin code can affect every site in the network. |
| Repair core or configuration files | The multisite installation root, including selected files | High privilege; access should be temporary and closely monitored. |
| Work on a test copy | The staging installation only | Use a distinct account or environment so production cannot be changed accidentally. |
The exact folder layout is host- and version-dependent. Ask the administrator to state the starting directory and whether the account can move above it. A login that appears to open a folder named after one subsite may still have access to shared network files.
How to ask for an account
Use a request that removes ambiguity. For example:
Please create an SFTP user for the WordPress multisite staging environment. The account needs read/write access only to the staging installation’s
wp-content/themes/example-childdirectory. Please provide the hostname, SSH port, username, and key or password, and confirm the account’s expiration date and starting path.Rank #2
Sale
Smart Watch for Men Women Compatible with iPhone Samsung Android Phone 1.69 inch Full Touch Screen IP68 Waterproof Bluetooh Fitness Tracker Heart Rate/Sleep Monitor (Black)
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
If the work genuinely requires network-wide files, say so and explain why. A host may document a multisite SFTP user that transfers files to and from sites in the network while offering optional restrictions to wp-content, plugins, themes, or uploads. Those options are useful, but availability and directory names differ by host.
Connect with an SFTP client
Information you need
Collect these values from the host:
- Host: a server name or IP address.
- Port: the SSH port; 22 is common, but the host may use another value.
- Username: the SFTP account, which may not match any WordPress username.
- Authentication: a password or a private SSH key, and any passphrase for that key.
- Starting directory: the folder in which the account lands after login.
Use an SFTP-capable client and select SFTP or SSH File Transfer Protocol, not plain FTP. In a graphical client, enter the host, port, username, and authentication details in the new-site connection screen. Verify the protocol label before saving the connection.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Command-line connection
On a system with the OpenSSH client, the syntax is:
sftp -P <port> <username>@<host>Replace the values with those supplied by the administrator. For key authentication, use the client’s identity option:
sftp -i <private-key-path> -P <port> <username>@<host>The first connection may ask you to verify the server’s host key. Confirm its fingerprint through a trusted host channel before accepting it. Never bypass a changed-key warning without checking: it can indicate a server rebuild, a DNS mistake, or an interception attempt.
Confirm what you can reach
After login, list the starting directory and inspect only the paths you were authorized to use. Confirm that:
- the directory belongs to the intended production or staging environment;
- you can perform the required read or write operation;
- you cannot navigate into unrelated customer or system directories; and
- the account does not unexpectedly expose private keys, backups, or configuration files.
Create a harmless test file only when the administrator permits it, then remove it. Do not upload a plugin, theme, or configuration change merely to test connectivity.
Can one SFTP user access only one subsite?
Sometimes, but this is a server-path feature rather than a WordPress multisite role. A host can restrict an account to a directory, and some installations place each site’s uploads in a separable path. However, shared themes, plugins, core files, and network configuration live outside an individual site’s content directory. A user limited to one uploads folder cannot safely perform tasks that require those shared files.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Ask the host to describe the boundary in filesystem terms. “Access to Site A” is not precise enough. Request the exact starting directory, allowed paths, and whether symbolic links or parent directories allow traversal outside the restriction. If the host cannot enforce a reliable boundary, use a separate staging copy or have the administrator perform the shared-file change.
Remember that a directory restriction does not turn SFTP into a dashboard role. Even a limited account may delete or replace every file within its allowed path, so grant write access only where it is necessary.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsWhy WordPress asks for FTP credentials when you have SFTP
WordPress uses a filesystem API for dashboard updates. Its FS_METHOD setting can be direct, ssh2, ftpext, or ftpsockets. These settings determine how WordPress itself writes updates; they are separate from the credentials you use in an external SFTP client.
A host can provide working SFTP access while WordPress still displays an FTP-credential prompt. Common causes include:
- the web-server PHP process cannot write to the target directory;
- files are owned by a different system user or group;
- the server lacks the PHP SSH2 support needed for the selected method;
FS_METHODhas been forced to an unsuitable value; or- the update is attempting to write outside the SFTP account’s permitted path.
Do not paste your SFTP password into WordPress’s prompt as a first response. First check the account and filesystem arrangement, then ask the host which filesystem method it supports.
Check ownership and permissions before editing
WordPress’s guidance is that files requiring write access should be owned by, or group-owned by, the account WordPress uses. That account is often the PHP or web-server user and may differ from your SFTP user. If your SFTP account creates files with incompatible ownership, later dashboard updates can fail even though the upload appeared successful.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchIn a multisite installation, inspect wp-content/uploads. The WordPress handbook notes that some installations may also require wp-content/blogs.dir to be writable. The required paths depend on the installation’s history and configuration, so confirm them with the administrator rather than changing every directory.
Avoid setting permissions to 777. It grants write access to every local user and can turn a minor file vulnerability into a site compromise. Protect wp-config.php more strictly than ordinary content files, and never change its permissions or ownership without understanding how the web server reads it.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Use Site Health as a diagnostic
In the WordPress dashboard, open Tools → Site Health → Info and find the Filesystem Permissions section. It reports whether WordPress can write to the main directory, wp-content, uploads, plugins, and themes. Record the result before changing permissions, then recheck it after the host corrects ownership or the PHP user.
If Site Health reports a failure, give the host the affected path and the exact operation that failed. Changing modes blindly can hide the underlying ownership problem and may expose the whole installation.
Free tools Windows power users keep installed
One-click scans. No signup required.
Production and staging access should be separate
Use staging for theme, plugin, and code work whenever it exists. Request a staging-specific SFTP account and verify the URL, database indicators, or host-panel label before transferring files. Production and staging may use similar directory names, making a mistaken connection easy to miss.
Do not copy production configuration files into a broadly shared staging account. Configuration can contain database passwords, salts, API keys, and paths that grant access beyond WordPress. If a task needs a production-only file, have the administrator transfer it or provide a narrowly scoped, time-limited account.
Password versus SSH-key authentication
| Option | How it works | Operational considerations |
|---|---|---|
| Password | The client proves knowledge of a server-issued password. | Easy to start, but must be unique, stored in a password manager, and rotated when staff or contractors leave. |
| SSH key | The server stores a public key; the client proves possession of the matching private key. | Strong for recurring access; protect the private key and its passphrase, and revoke the public key when access ends. |
The host decides which methods are available. Never email a private key or paste it into a support ticket. If a key is lost or exposed, ask the administrator to remove it immediately and issue a replacement.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Protect and revoke SFTP access
SFTP credentials should be handled like administrative credentials. Keep them in an approved password manager or secure key store, use encrypted SFTP only, and do not share one person’s login with an entire team. Record who has access and which environment the account reaches.
When the task ends:
- Remove temporary users or disable their shell and SFTP access.
- Rotate passwords or remove the corresponding SSH public keys.
- Review path restrictions and return the account to read-only or no access when possible.
- Check the changed files and review server or hosting logs for unexpected activity.
- Confirm that WordPress Site Health and dashboard updates still report the expected filesystem permissions.
Never paste SFTP credentials into a ticket, chat room, deployment script, or document that is accessible to people who do not need them.
Choosing between common access arrangements
| Decision | Safer default | When another choice may be justified |
|---|---|---|
| Environment | Staging first | Production-only incident or release task. |
| Filesystem scope | Path-restricted directory | Core repair or network-wide plugin/theme work requires broader access. |
| Authentication | SSH key with a protected passphrase | A host or short-lived emergency account supports password only. |
| Account ownership | Named host-managed or server-managed user | A tightly controlled deployment service account is appropriate and audited. |
| Operator need | Only uploads, themes, or plugins required for the task | The operator is responsible for the complete network filesystem. |
Exact account features vary by host. Ask for the restriction, authentication, and environment details in writing rather than inferring them from the username or the folder shown after login.
Troubleshoot the most common failures
“Authentication failed”
- Confirm that you selected SFTP, not FTP or FTPS.
- Check the hostname, non-default port, username, and key or password exactly as issued.
- Ask whether the account is enabled for the production or staging environment you selected.
- Have the administrator verify that your IP address is not blocked by a firewall or allow-list.
“Permission denied” while uploading
- Confirm that the account has write permission to that exact directory.
- Check whether the directory is owned by the PHP/web-server account rather than the SFTP account.
- Review Site Health’s Filesystem Permissions report.
- Ask the host to correct ownership or grant a narrowly scoped group permission; do not use
777as a shortcut.
The file uploads, but WordPress cannot update
The SFTP user and the PHP process may be different system users. Ask the administrator to align ownership or group access with the account WordPress uses, and verify the affected plugins, themes, uploads, or main directory in Site Health.
The client shows the wrong site
Stop the transfer. Confirm the environment label, starting path, and server host with the provider. Production and staging can have similar folder names, and a successful login does not prove that you reached the intended installation.
What SFTP access does not provide
- It does not create a WordPress user or grant dashboard access.
- It does not automatically grant database access, WP-CLI access, or hosting-panel access.
- It does not isolate one subsite unless the server enforces a filesystem boundary.
- It does not make a file change reversible; keep a tested backup and change record before high-risk edits.
Network administration remains an application-level role. In a multisite network, users are shared in common tables, but a person must still be assigned a role on an individual site before dashboard access exists. Filesystem authority is independent and can be substantially broader.
A safe handoff checklist
- Identify the exact production or staging environment.
- Name the files or directories required for the job.
- Ask the host or server administrator to create a separate SFTP account.
- Require SFTP encryption and confirm the SSH port.
- Choose a password or SSH key and store it securely.
- Verify the starting directory and test the permitted scope without changing live files.
- Check ownership and Site Health before editing.
- Back up or otherwise document high-risk files before replacement.
- Make the smallest change necessary and verify the site.
- Disable or revoke the account when the work is complete.
Frequently Asked Questions
Can my WordPress network administrator tell me the SFTP password?
Usually no. SFTP credentials are issued by the hosting provider or server administrator, not stored as a normal WordPress role credential. Ask the host to create or reset a separate SFTP account.
Do I need SFTP if my host offers a cPanel File Manager?
A File Manager can provide another filesystem route, but SFTP is the preferred encrypted option when the host offers it. Choose the method that gives the required access with the narrowest scope.
Can I use my WordPress dashboard password for SFTP?
No. The two accounts are separate unless an administrator deliberately configured identical credentials, which is poor security practice. Use the username and authentication details supplied for the SFTP account.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Why can I list a folder but not edit a file?
Listing requires read and directory-traverse permissions; editing also requires write permission and compatible ownership. The host must grant write access to the required path and ensure WordPress’s PHP account can still use the files.
What should I do if an SFTP key or password may have leaked?
Ask the host or server administrator to disable the account or remove the public key immediately, rotate related credentials, review logs, and inspect recently changed files before issuing replacement access.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
