Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more

To get SFTP access to a WordPress multisite, ask the hosting provider or server administrator to create an SFTP account for the exact production or staging environment you need. They must give you the SFTP hostname, port, username, and either a password or SSH key. Connect with an SFTP-capable client, then confirm whether the account opens the shared multisite installation or a restricted directory such as wp-content/uploads. SFTP is administrative file access: use encryption, limit the path, and verify ownership and permissions before editing anything.

What SFTP access means on a WordPress multisite

SFTP is Secure File Transfer Protocol carried through SSH. It encrypts the connection and the files and credentials sent over it. It is different from ordinary FTP and from the WordPress dashboard login. The account is created at the server or hosting layer, so a normal WordPress role such as Administrator, Editor, or Network Administrator does not automatically provide SFTP credentials.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

A multisite network contains multiple sites that share one WordPress core installation. Network administration also uses shared user tables, but dashboard access is assigned per site: a user must have a role on a particular site before that site appears in the dashboard. Neither fact determines what the SFTP account can see. The host controls the filesystem root, chroot or jail, and write permissions assigned to the SFTP user.

Depending on the account, you may see the complete WordPress installation, only wp-content, a plugins or themes directory, or one site’s uploads directory. A restricted account can be ideal for a content migration or media task; a full installation account is needed for some network-level code changes but carries much greater risk.

#1 Best Overall
Sale
Compressed Air Duster,130000RPM Super Power Cordless Air Duster,Rechargeable Brushless Blower,3 Gear Adjustable Blower with LED Light,Dust Remover for Computer/House/Outdoor/Car
  • Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
  • With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
  • Wide Application:Upgraded attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
  • Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
  • Warranty & Support: Our Electric air duster comes with 5 years warranty and 24/7 customer service. During this period, if you have any questions,pls kindly feel free to contact us.

Identify the environment and the person who controls it

Start by deciding exactly where the work belongs. Production and staging commonly have separate server names and separate users. Do not use a production credential for a staging change or assume that a staging account will reveal production files.

  • Environment: state whether you need production, staging, development, or a temporary copy.
  • Network: provide the multisite domain and, if relevant, the network’s primary domain so support can select the correct server.
  • Task: describe whether you need to edit a theme, install a plugin, move uploads, inspect logs, or perform a network-wide change.
  • Required path: request only the directory needed for that task.
  • Duration: specify an expiry date for temporary access.

On managed hosting, the provider normally creates the account from an SFTP or SSH-users screen, or support creates it for you. On a self-managed server, a system administrator must create the operating-system account, select its home directory, set its shell or SFTP-only restriction, and assign ownership or group membership. In both cases, the server administrator—not WordPress—issues the credentials.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Request the narrowest SFTP account that will work

Send the host a precise request rather than asking for a generic FTP login. Include the environment, desired path, authentication preference, and the people who need access. A useful request identifies whether the job requires all network files or only uploads, plugins, or themes.

  1. Open the host’s SFTP/SSH user page or contact support. If the host offers separate controls for production and staging, choose the correct one.
  2. Name the account. Use a unique, non-personal name for a team or temporary task, and record who is responsible for it.
  3. Set the home directory or path restriction. Ask for the smallest directory that contains the files you must change. A host may offer restrictions to wp-content, plugins, themes, or uploads. If a network-wide operation genuinely needs the installation root, have the provider confirm that explicitly.
  4. Choose authentication. Prefer an SSH key when the host supports it. Otherwise request a strong, unique password that is not used for WordPress, email, or another server.
  5. Request connection details. Obtain the hostname, port, username, and password or the key-registration instructions. Ask whether the account is read-only, SFTP-only, or also allowed to use an interactive SSH shell.
  6. Confirm the expiry and removal process. Temporary accounts should have an end date, and the provider should tell you how to disable or rotate the account.

Some managed WordPress services document a multisite SFTP user that can transfer files to and from sites in the network while allowing optional restrictions to wp-content, plugins, themes, or uploads. Exact controls differ by host, so treat those as examples of possible scope rather than a universal feature.

Connect with an SFTP client

Use any client that explicitly supports SFTP, or the sftp command included with many operating systems. Do not select plain FTP just because the client lists it first.

Rank #2
EVEO® Screen Cleaner Spray Kit (Streak-Free) TV Screen Cleaner for Smart TV, Lcd, LEd, Oled | Computer Screen Cleaner Spray and Wipe Microfiber Cloth - TV, Monitor, Laptop, iPad, Car - 6.7oz 1 Pack
  • Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
  • Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
  • Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
  • Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
  • Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
  1. Verify the server identity. The host should provide a hostname and, where available, an SSH host-key fingerprint. On the first connection, compare the fingerprint through a trusted support channel before accepting it. A changed key can indicate a server migration, but it can also indicate a security problem.
  2. Enter the supplied hostname and port. Use the port provided by the host; do not assume that the WordPress URL or a default port is correct.
  3. Enter the SFTP username. This is usually a server account and may not match any WordPress username.
  4. Authenticate with the supplied password or private key. If a key is used, keep the private key on a protected device and enter its passphrase only in the client.
  5. Check the initial directory. The first folder shown reveals the account’s effective scope. Look for the expected WordPress files or the restricted folder named by the host.
  6. Perform a harmless test. Download a small, non-sensitive file or list a directory before uploading anything. Confirm that the path is the intended environment.

From a terminal, the pattern is sftp -P 2222 user@server.example, replacing the example port, username, and hostname with the values supplied by the administrator. The command does not bypass a path restriction; it uses exactly the permissions assigned to that account.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

How multisite filesystem scope is usually arranged

Ask the host to describe scope in filesystem terms, not in WordPress role names. The following arrangements are common possibilities, but the host’s account design is authoritative.

Arrangement What the account may expose Suitable use Main risk
Full installation or server root WordPress core, wp-config.php, wp-content, and network files Network-level maintenance performed by a trusted administrator A mistake can disable every site or expose secrets
wp-content only Plugins, themes, uploads, and related content directories Theme or plugin deployment and media operations Still permits code changes across the network
Plugins or themes only One or more selected extension directories Deploying a vetted extension without core access Extension code can affect all sites that use it
Uploads only Media files for a network or selected site path Bulk media transfer or recovery Does not permit code repair; incorrect paths can mix sites’ media
Staging-only account The staging installation and its content Testing changes before production deployment Changes are not visible on production and may be discarded during a refresh

A request such as “access only subsite 3” may not map cleanly to a directory. Multisite stores shared core and network components together, and the location of uploads depends on the installation and WordPress version. The host can create a jailed path if its filesystem layout and server controls support it; otherwise the practical boundary may be wp-content/uploads or another shared directory rather than a single dashboard site.

Can an SFTP user be limited to one subsite?

Sometimes, but it is a hosting design question rather than a WordPress setting. A provider may be able to jail an account to one uploads directory, create a separate staging copy, or use operating-system permissions to expose only selected paths. Other providers place all network files under one account, making a true per-subsite filesystem boundary impractical.

Before accepting an account, ask these questions:

  • Does the starting directory contain files for every site in the network?
  • Can the account read or write wp-config.php, plugins, themes, or other sites’ uploads?
  • Is the restriction enforced by the server, or is it merely an instruction not to browse elsewhere?
  • Will a deployment or backup process reset the directory or permissions?

If the task needs only one site’s media, a path-restricted uploads account is safer than a network-wide account. If it needs a theme or plugin used by several sites, the administrator should treat it as network-level access even when the change was requested for one subsite.

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Rank #3
BladeHawks RGB Gaming Mouse Pad Extra Large Extended 31.5x12 Inch-Black
  • 【Large size】:Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
  • 【LED backlight mouse pad】:Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
  • 【Anti-slip rubber base】:Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
  • 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
  • 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.

Check ownership and permissions before changing files

Successful login does not guarantee that WordPress can use the files you upload. WordPress expects files that need write access to be owned by, or group-owned by, the account used by the web process. If an SFTP account uploads files under a different owner or group, dashboard updates, plugin installation, image processing, or automatic upgrades may fail later.

Before editing, open the WordPress dashboard and inspect the Filesystem Permissions information in Tools → Site Health. The report can show write access for the main directory, wp-content, uploads, plugins, and themes. On a multisite, check the affected network and site paths rather than assuming one result covers every location.

The multisite handbook notes that wp-content/uploads must be writable for media operations. Some older or customized installations may also require wp-content/blogs.dir to be writable. Do not change either path merely because a guide mentions it; first confirm that the directory exists in this installation and that Site Health identifies a real write problem.

  • Preserve the existing owner and group when replacing a file.
  • Use the host’s documented permission model and the least privilege needed for the task.
  • Never “fix” a failed update by applying broad 777 permissions; that allows every local process to write and can create a serious security exposure.
  • Treat wp-config.php more strictly than ordinary content files because it contains database and authentication secrets.

If you cannot inspect or correct ownership safely, stop and ask the server administrator to perform the change. Repeatedly changing modes from an SFTP client can make the account appear functional while leaving the web process unable to write.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

SFTP login settings and WordPress FS_METHOD are separate

WordPress has its own filesystem API for installing updates from the dashboard. The FS_METHOD constant can be set to direct, ssh2, ftpext, or ftpsockets. Related constants can hold FTP or SSH connection details. These settings govern how WordPress performs an update; they do not create an SFTP user and do not reveal the credentials issued by the host.

Rank #4
Sale
Vaydeer Wrist Rest for Keyboard and Mouse, Computer Ergonomic Wrist Support Pad, Soft Memory Foam Arm Cushion for Desk, Palm Hand Office Laptop Typing
  • 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
  • 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
  • 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
  • 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
  • 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Situation What controls it What to do
You cannot log in with an SFTP client Host account, hostname, port, authentication, and network access Ask the provider to verify the account, environment, and allowed protocol
The dashboard asks for FTP credentials during an update WordPress filesystem method plus file ownership Check Site Health, the PHP/web-server user, and the host’s supported update method
An SFTP upload succeeds but WordPress cannot update the file Owner, group, and directory permissions Have the administrator align ownership and permissions; do not use 777
You want WordPress to use SSH for updates FS_METHOD=ssh2 and the required PHP SSH support and credentials Follow the host’s documented configuration; an ordinary SFTP login alone is not sufficient

WordPress’s hardening guidance recommends SFTP encryption when the host provides it. That recommendation concerns the transport used to connect. It does not mean that changing FS_METHOD is required for every manual SFTP transfer.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Troubleshoot the most common failures

The client says the password or key is invalid

Confirm that you selected SFTP rather than FTP, copied the username exactly, and used the port assigned to the correct environment. Ask the host whether the account is locked, expired, restricted by IP address, or configured for key-only authentication. Do not test a WordPress dashboard password as a substitute; the two credentials are independent.

The connection works but the expected files are missing

You are probably in a restricted home directory, on staging instead of production, or on a different server in the host account. Check the initial path and compare it with the directory the administrator promised. Ask support to state the absolute server path and whether the account is jailed. Do not navigate upward repeatedly in an attempt to escape a restriction.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

You receive permission denied when uploading

Read access and write access may be different. The directory can be owned by the web server account, another deployment account, or a group to which your SFTP user does not belong. Record the exact path and error, then ask the administrator to fix ownership or grant the minimum group permission required.

WordPress keeps requesting FTP credentials

Use Site Health’s Filesystem Permissions report to identify which directory is not writable. Compare the web process user with the owner of the files uploaded through SFTP. If the host supports direct updates, it may recommend a specific FS_METHOD; do not add arbitrary constants copied from an unrelated server. Have the host verify PHP SSH support if an ssh2 method is required.

Best Value
Sale
Under Desk Cable Management Tray No Drill, Metal Mesh Cable Management Under Desk with Clamp Mount, 2 Hole Cable Tray with Wire Management and Cord Organizer for Home Office Standing Desk
  • 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
  • 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
  • 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
  • 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
  • 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.

Files changed on one site affect every site

You likely edited a shared plugin, theme, or core file. Multisite code is commonly shared even though the dashboards are separate. Restore the original file from a trusted backup, test the network in staging, and ask for a path restriction before continuing. A subsite administrator should not receive network-wide code access merely because the requested change concerns one site.

Protect the account while work is in progress

Handle SFTP credentials as administrative credentials. On WordPress.com, the provider explicitly warns that users with SFTP or SSH credentials have administrative privileges to add, modify, and remove site files and settings. That level of access can bypass dashboard role restrictions and can expose configuration secrets.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
  • Store passwords in a password manager and private keys in protected, encrypted storage.
  • Do not paste credentials into a support ticket, chat transcript, email, or shared document.
  • Use separate accounts for separate people or contractors so access can be audited and revoked individually.
  • Prefer a path restriction and an SFTP-only account when an interactive shell is unnecessary.
  • Use staging for testing and take a verified backup before a production code change.
  • Confirm the host key on first connection and investigate unexpected key changes.

Revoke or reduce access when the task ends

Temporary access should not remain active indefinitely. Delete or disable the SFTP user, revoke its SSH key, or rotate its password as soon as the work is complete. If the account must remain for ongoing maintenance, reduce its path and permissions to the smallest continuing requirement and set a review date.

Ask the administrator to confirm that removed users cannot still connect through another SSH account, deployment key, or shared credential. Review the files changed during the session, remove temporary archives or database dumps from web-accessible directories, and verify the site and network in both the dashboard and the public browser. If an account had access to wp-config.php or other secrets, rotate affected credentials according to the host’s incident procedure.

A practical request and verification checklist

  1. Identify production or staging and the exact multisite network.
  2. Describe the task and the smallest directory it requires.
  3. Ask the host or server administrator to create an SFTP-only user with an expiry date.
  4. Obtain the hostname, port, username, and password or SSH-key instructions through a secure channel.
  5. Verify the host key, connect with an SFTP client, and confirm the starting directory.
  6. Check Site Health’s Filesystem Permissions information before uploading or replacing files.
  7. Back up the affected files, make the smallest change, and test the relevant sites.
  8. Have the administrator remove or restrict the account when the work is finished.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.