Getting file and shell access to a site

Every site has its own file access. Sites → your site → Access.

SFTP

The host, port, username and a password you generate on that screen. Any SFTP client works — FileZilla, Cyberduck, your editor's built-in one. The account is confined to that one site's files, so an SFTP credential for one site cannot read another.

SSH

Add your public key on the same screen and connect with your usual client. Password SSH is deliberately not offered: a key cannot be guessed, and a shared server with password SSH is a shared server that will eventually be brute-forced.

If you do not have a key yet, ssh-keygen -t ed25519 on your own machine creates one. The file ending .pub is the one you paste in; the other one never leaves your computer.

What you get in the shell

Your site's files, wp-cli on WordPress sites, composer, and the PHP version the site is set to. You are inside the site's own isolated environment — you cannot see another customer's files, and neither can they see yours.

Why credentials are per site rather than per account

Because access is the thing most often shared with a contractor, and one credential per site means you can give somebody exactly the site they are working on. Revoking it later affects nothing else.

⭐ For a person rather than a machine, add them to your team instead (Organisation → Team) — they then sign in as themselves, their access is logged under their own name, and removing them removes everything at once.