SSH Access

Hosting Skills & Tools

SSH Access in Web Hosting: What It Is and How to Use It

The command line gives you more control over your server than any dashboard ever will

📖 ~5,000 words ⌨️ Beginner to Intermediate ⚡ Updated 2026

📋 What’s in this guide

  1. What SSH Is
  2. How SSH Works
  3. SSH vs. FTP: Why SSH Wins
  4. What You Can Do with SSH
  5. Does Your Host Support SSH?
  6. Connecting: Mac & Linux
  7. Connecting: Windows
  8. SSH Key Authentication
  9. Essential SSH Commands
  10. WP-CLI: SSH for WordPress
  11. SSH Security Best Practices
  12. SSH Quick Reference

Every hosting control panel gives you a dashboard full of buttons, file managers, and one-click installers. They’re convenient for common tasks. But there’s a ceiling — and once you hit it, the only way through is the command line.

SSH (Secure Shell) is a protocol that lets you open a direct, encrypted terminal session to your server from your own computer. With it, you can do in seconds what would take minutes in a control panel — or do things the control panel simply can’t do at all. Move ten thousand files, run database migrations, manage cron jobs, install WP-CLI, debug errors in real time, restart services, and transfer files securely between servers.

This guide covers SSH completely — what it is, how it works, how to connect from any operating system, the commands you’ll actually use, and how to stay secure while doing it. Whether you’ve never opened a terminal or you’re comfortable with the basics and want to go deeper, this guide has you covered.

1. What SSH Is

SSH stands for Secure Shell. It’s a network protocol that creates an encrypted connection between your local computer (the client) and a remote server. Once connected, you get a command-line interface directly on that server — as if you were sitting in front of it in the data centre.

Everything you type in an SSH session is transmitted encrypted. Everything the server sends back is encrypted. Nobody between you and the server — not your ISP, not a malicious actor on a shared network — can read the session contents. This is SSH’s core advantage over older remote access protocols like Telnet, which transmitted everything in plain text.

SSH was designed in 1995 as a secure replacement for Telnet and rsh. It’s now the universal standard for remote server management across the internet. Almost every web server, VPS, cloud instance, and dedicated server in the world runs an SSH daemon and accepts SSH connections.

🔐
SSH Is a Protocol, Not Just a Tool

SSH is the underlying protocol. The tool you use to make an SSH connection on your computer is called an SSH client — on Mac and Linux it’s the built-in ssh command; on Windows it’s PowerShell’s built-in SSH client or a dedicated app like PuTTY. The server runs an SSH daemon (usually OpenSSH, the sshd process) that listens for incoming connections on port 22 by default.

2. How SSH Works

Understanding the mechanics of SSH gives you a clearer mental model for troubleshooting connection issues and configuring security correctly.

How an SSH Connection Is Established

💻
Your Computer
SSH client
initiates request
→
🔑
Handshake
Keys exchanged,
identity verified
→
🔒
Encrypted Tunnel
All traffic encrypted
end-to-end
→
🖥️
Your Server
Full shell access
granted

✅ Encrypted end-to-end — safe on any network

The SSH Handshake

When you run ssh [email protected], the following happens in under a second:

  1. TCP connection: Your client connects to the server on port 22 (or a custom port if configured)
  2. Protocol negotiation: Client and server agree on the SSH version and supported encryption algorithms
  3. Server authentication: The server sends its host key — a unique fingerprint. Your client checks this against known hosts. The first time you connect, you’re asked to verify and accept it. On subsequent connections, a mismatch triggers a warning (which means either the server changed or something suspicious is happening)
  4. Client authentication: You prove you’re allowed to log in — either by entering a password or by presenting a cryptographic key pair (more secure)
  5. Session established: An encrypted channel opens and you get a shell prompt on the remote server

Port 22 and Custom Ports

SSH listens on port 22 by default. Security-conscious administrators often move it to a non-standard port (like 2222 or 2200) to reduce exposure to automated scanners that constantly probe port 22. If your host uses a non-standard SSH port, they’ll tell you — you specify it with the -p flag: ssh -p 2222 [email protected].

3. SSH vs. FTP: Why SSH Wins

FTP (File Transfer Protocol) used to be the standard way to upload files to a web server. Many hosting beginners still use it. SSH is strictly superior in almost every dimension.

✅ SSH / SFTP

  • All traffic fully encrypted — credentials and data protected
  • Single encrypted connection — no separate data channel issues with firewalls
  • Full interactive shell access — not limited to file transfers
  • Run commands, manage processes, edit files in-place
  • Key-based auth eliminates password theft risk
  • Works reliably through firewalls and NAT
  • Industry standard — supported everywhere
  • Can tunnel other protocols securely through the connection

❌ Plain FTP

  • No encryption — username, password, and all file contents sent in plain text
  • Uses two channels (control + data) — notoriously difficult with firewalls
  • File transfer only — no command execution
  • Password-only authentication — vulnerable to credential interception
  • Active mode FTP blocked by many modern firewalls by default
  • Should never be used on public or shared networks
💡
SFTP Is SSH, Not FTP

SFTP (SSH File Transfer Protocol) sounds like a variant of FTP but it’s actually a completely different protocol that runs over SSH. It provides encrypted file transfer using your SSH credentials and key, through the same port 22 connection. If your hosting account has SSH access, it almost certainly also supports SFTP. Use SFTP in your FTP client (FileZilla, Transmit, Cyberduck) instead of plain FTP — it’s the same workflow but fully encrypted.

4. What You Can Do with SSH

SSH unlocks a fundamentally different level of server access. Here are the most practical capabilities it gives you in a hosting context.

📁 File Operations at Scale

Move, copy, rename, and delete thousands of files instantly. Bulk-rename with patterns. Set file permissions across entire directory trees in a single command.

🗜️ Compress & Extract

Create and extract .zip, .tar.gz archives server-side — without downloading to your computer. Critical for large sites where uploading a zip is far faster than individual files.

🗄️ Database Management

Import and export large MySQL databases in seconds via the command line — no phpMyAdmin timeouts for large databases. Run queries directly against production data.

⏱️ Cron Jobs & Processes

Inspect running processes with top, manage cron jobs, kill runaway processes, and monitor resource usage in real time.

🔌 WP-CLI for WordPress

Manage WordPress from the command line: update plugins in bulk, reset passwords, run search-replace across the database, manage users, and import content at scale.

🐛 Real-Time Debugging

Tail log files live as errors happen. Search error logs with grep to find specific issues instantly across large log files.

🔄 Git Version Control

Clone repositories, pull updates, manage branches, and deploy code changes directly from the server using Git — the foundation of modern deployment workflows.

🚀 Package Management

Install and manage server software with package managers like apt or yum on VPS and dedicated servers. Install Composer, Node.js, Python packages.

🔐 Secure File Transfer

Copy files between your local machine and server — or between two remote servers — using SCP or rsync, both of which use SSH for encryption.

5. Does Your Host Support SSH?

SSH availability depends heavily on your hosting type. Here’s what to expect across each tier.

Hosting TypeSSH Available?Notes
Shared HostingOften yes — check plan detailsSome restrict SSH to higher-tier plans. SiteGround, Bluehost, A2/Hosting.com, DreamHost all offer SSH. Hostinger includes it on most plans.
Managed WordPressUsually yesWP Engine, Kinsta, and Flywheel all provide SSH access. Often includes WP-CLI pre-installed.
VPS HostingAlways yesFull root SSH access is the defining feature of VPS. You receive login credentials at provisioning.
Cloud HostingAlways yesAWS, GCP, DigitalOcean, Linode — all provide SSH, typically via key-based auth only.
Dedicated ServersAlways yesFull root access. You get complete control of the SSH daemon configuration.

How to Enable SSH on Shared Hosting

If your shared host supports SSH but it isn’t enabled by default, you typically enable it through your hosting control panel:

  • cPanel: Look for “SSH Access” or “Manage Shell Access” under the Security section. Toggle “Shell Access” to enabled. Your SSH username and password are usually the same as your cPanel credentials.
  • SiteGround Site Tools: Devs → SSH Keys — you generate and upload an SSH key here rather than using password authentication.
  • Hostinger hPanel: Advanced → SSH Access — toggle to enable and note your SSH port (often non-standard on shared hosting).
🔍
Finding Your SSH Credentials

After enabling SSH, you’ll need: your hostname (usually your domain or your server’s IP address), your username (often your cPanel username), your port (22 by default, but many shared hosts use a non-standard port like 2222 — check your host’s documentation), and either your password or an SSH key pair. Most hosts display this information in the SSH Access or SSH Keys section of your control panel.

6. Connecting via SSH: Mac & Linux

Mac and Linux include a full SSH client built in. Open Terminal (Mac: Applications → Utilities → Terminal; Linux: your distribution’s terminal emulator) and you’re ready.

Basic Connection Command

Terminal — basic SSH connection ssh [email protected] # With a custom port: ssh -p 2222 [email protected] # With a specific key file: ssh -i ~/.ssh/my_key [email protected]

First Connection: Accepting the Host Key

The first time you connect to a server, you’ll see a message like this:

First connection prompt The authenticity of host 'yourdomain.com (104.21.45.32)' can't be established. ED25519 key fingerprint is SHA256:abc123xyz... Are you sure you want to continue connecting (yes/no/[fingerprint])?

Type yes and press Enter. The server’s fingerprint is saved to ~/.ssh/known_hosts on your machine. On future connections, SSH automatically verifies this fingerprint — if it changes unexpectedly, SSH will warn you, which is an important security signal.

Successful Connection

Successful SSH session Warning: Permanently added 'yourdomain.com' to the list of known hosts. [email protected]'s password: # Enter your password (nothing visible while typing — this is normal) Last login: Mon Mar 24 09:12:33 2026 from 203.0.113.42 [username@server ~]$ # You're in. The $ prompt means you're logged into the remote server.

Using SSH Config for Shortcuts

If you connect to the same server regularly, create an SSH config file to save typing:

~/.ssh/config Host mysite HostName yourdomain.com User username Port 2222 IdentityFile ~/.ssh/my_key

With this saved, connecting becomes simply:

Terminal — using SSH config alias ssh mysite

7. Connecting via SSH: Windows

Windows 10 and Windows 11 include a built-in OpenSSH client — no software installation required.

Using Windows PowerShell or Command Prompt (Built-in)

Open PowerShell or Command Prompt and use the same ssh syntax as Mac and Linux:

PowerShell / Command Prompt ssh [email protected] ssh -p 2222 [email protected]

If the built-in SSH client isn’t available (older Windows 10 builds), enable it via: Settings → Apps → Optional Features → Add a Feature → OpenSSH Client.

Using PuTTY (Popular GUI Alternative)

PuTTY is a free, widely used SSH client for Windows with a graphical interface. Download it from putty.org.

  1. Open PuTTY
  2. In “Host Name (or IP address)”, enter your domain or server IP
  3. Set “Port” to 22 (or your host’s custom SSH port)
  4. Connection type: SSH
  5. Click “Open”
  6. Accept the host key fingerprint on first connection
  7. Enter your username and password when prompted
💡
Windows Terminal Is Worth Installing

Microsoft’s Windows Terminal (free from the Microsoft Store) is a significant upgrade over the default Command Prompt. It supports multiple tabs, proper Unicode rendering, colour schemes, and a much more comfortable experience for SSH sessions. If you use SSH regularly on Windows, install Windows Terminal — you’ll notice the difference immediately.

8. SSH Key Authentication

Password authentication for SSH is convenient but has real weaknesses — passwords can be brute-forced, phished, or intercepted. SSH key authentication is more secure, more convenient once set up, and the standard approach for cloud servers and managed hosting providers.

How Key Authentication Works

SSH key authentication uses a matched pair of cryptographic keys:

  • Private key — stays on your computer only. Never shared, never transmitted. Treat this like a physical house key.
  • Public key — placed on the server in ~/.ssh/authorized_keys. The server uses this to verify that you hold the matching private key. It’s safe to share — it’s mathematically useless without the private key.

When you connect, the server sends a challenge encrypted with your public key. Your SSH client decrypts it using your private key and sends back the proof. No password ever crosses the network.

Generating an SSH Key Pair

Terminal (Mac / Linux / Windows PowerShell) ssh-keygen -t ed25519 -C "[email protected]" Generating public/private ed25519 key pair. Enter file in which to save the key (/Users/you/.ssh/id_ed25519): # Press Enter to accept default location Enter passphrase (empty for no passphrase): # Add a passphrase for extra security (recommended) Your identification has been saved in /Users/you/.ssh/id_ed25519 Your public key has been saved in /Users/you/.ssh/id_ed25519.pub

This creates two files: id_ed25519 (private key — guard carefully) and id_ed25519.pub (public key — safe to share).

Copying Your Public Key to the Server

Terminal — copy public key to server (Mac/Linux) ssh-copy-id [email protected] # With custom port: ssh-copy-id -p 2222 [email protected]

If ssh-copy-id isn’t available (Windows, or manual setup), copy the public key content manually:

Manual method — append public key to authorized_keys on server # First, view your public key: cat ~/.ssh/id_ed25519.pub # Copy the output. Then on the server, run: mkdir -p ~/.ssh echo "paste-your-public-key-here" >> ~/.ssh/authorized_keys chmod 600 ~/.ssh/authorized_keys chmod 700 ~/.ssh
⚠️
Permissions Matter

SSH is strict about file permissions on the ~/.ssh directory and authorized_keys file. If permissions are too open, SSH refuses to use the key as a security measure. The directory must be 700 (owner read/write/execute only) and the authorized_keys file must be 600 (owner read/write only). The chmod commands above set this correctly.

Shared Hosting: Uploading Keys via Control Panel

On shared hosting with cPanel, go to Security → SSH Access → Manage SSH Keys → Import Key. Paste the contents of your .pub file and click Import. Then authorize the key. Your host handles the authorized_keys setup automatically.

9. Essential SSH Commands

These are the commands you’ll actually reach for in a hosting context. Each one is immediately practical.

Navigation & File Management

Navigation essentials pwd # Print current directory path ls -la # List files with permissions, sizes, hidden files cd public_html # Change directory cd .. # Go up one level cd ~ # Go to home directory
File operations cp file.php backup_file.php # Copy a file cp -r folder/ folder_backup/ # Copy a directory recursively mv old_name.php new_name.php # Rename or move a file rm file.php # Delete a file (no recycle bin!) rm -rf folder/ # Delete a directory and all contents mkdir new_folder # Create a directory touch newfile.txt # Create an empty file

Permissions

File permissions chmod 644 file.php # Owner read/write, others read-only (standard for files) chmod 755 directory/ # Owner all, others read/execute (standard for dirs) chmod -R 644 public_html/ # Apply recursively to all files chown user:group file.php # Change file ownership

Archives

Compress and extract — server-side zip -r backup.zip public_html/ # Create a zip archive unzip backup.zip # Extract a zip archive tar -czf backup.tar.gz public_html/ # Create .tar.gz archive tar -xzf backup.tar.gz # Extract .tar.gz archive

Database Operations

MySQL via command line # Export (dump) a database to a file: mysqldump -u db_user -p db_name > backup.sql # Import a .sql file into a database: mysql -u db_user -p db_name < backup.sql # Open interactive MySQL shell: mysql -u db_user -p

Viewing & Searching Files

File viewing and searching cat wp-config.php # Print file contents tail -f error_log # Watch a log file in real time (Ctrl+C to stop) grep -r "fatal error" logs/ # Search recursively for a string grep -n "wp_query" functions.php # Find line numbers of matches find . -name "*.log" # Find all files matching a pattern find . -newer reference.php # Files modified more recently than reference.php

Secure File Transfer: SCP & rsync

SCP — secure copy between local and remote # Upload a file to the server: scp localfile.zip [email protected]:~/public_html/ # Download a file from the server: scp [email protected]:~/backup.sql ./ # rsync — efficient sync, skips unchanged files: rsync -avz ./local_folder/ [email protected]:~/public_html/

10. WP-CLI: SSH for WordPress

WP-CLI is the command-line interface for WordPress. If you run WordPress and have SSH access, WP-CLI is one of the most powerful tools available to you — it turns time-consuming dashboard tasks into single commands.

Installing WP-CLI

Install WP-CLI on your server curl -O https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli.phar chmod +x wp-cli.phar sudo mv wp-cli.phar /usr/local/bin/wp wp --info # Verify installation

Many managed WordPress hosts (Kinsta, WP Engine, SiteGround) pre-install WP-CLI — just type wp --info to check if it’s already available.

Essential WP-CLI Commands

WP-CLI — the commands you’ll actually use # Update WordPress core: wp core update # Update all plugins at once: wp plugin update --all # Update all themes: wp theme update --all # List all plugins and their status: wp plugin list # Reset a user's password: wp user update admin --user_pass=NewSecurePassword123! # Search and replace in the database (e.g. after moving domain): wp search-replace 'https://oldsite.com' 'https://newsite.com' # Export the database: wp db export backup.sql # Import a database: wp db import backup.sql # Flush rewrite rules (fixes 404s after migration): wp rewrite flush # Clear all caches: wp cache flush # Check site for errors: wp doctor check --all
🚀
Search-Replace Is WP-CLI’s Killer Feature

When you migrate a WordPress site to a new domain or move from HTTP to HTTPS, the database contains hundreds of references to the old URL — in post content, widget settings, theme options, serialised arrays. Fixing these manually through phpMyAdmin is error-prone and dangerous with serialised data. WP-CLI’s wp search-replace command handles serialised data correctly, making domain migrations that used to take hours reliable and instant.

11. SSH Security Best Practices

SSH is inherently secure, but misconfiguration can undermine that security. These practices apply to VPS and dedicated server owners who manage their own SSH daemon. Shared hosting users have less control but should still follow the client-side practices.

Client-Side Best Practices (Everyone)

  • Use key-based authentication, not passwords. An SSH key is mathematically stronger than any password and can’t be phished. Once key auth is set up, disable password auth on the server if you have that level of access.
  • Protect your private key with a passphrase. If your computer is stolen, a passphrase-protected private key is useless to the thief. Use ssh-agent to avoid re-entering the passphrase constantly during a session.
  • Never share your private key. If multiple people need access to a server, each person generates their own key pair and their public key is added to authorized_keys separately.
  • Verify host fingerprints on first connection. When connecting to a new server, ask your host or check their dashboard for the expected fingerprint. A mismatch on a subsequent connection is a serious security warning — don’t ignore it.

Server-Side Best Practices (VPS / Dedicated)

  • Disable root login over SSH. Set PermitRootLogin no in /etc/ssh/sshd_config. Log in as a regular user and use sudo for privileged commands.
  • Disable password authentication. Once key auth is working, set PasswordAuthentication no. This eliminates brute-force password attacks entirely.
  • Change the default SSH port. Moving from port 22 to a non-standard port (2222, 2200, etc.) eliminates the bulk of automated scanning noise. Not a security measure against a targeted attacker, but it dramatically reduces log clutter and opportunistic probing.
  • Use fail2ban. This tool monitors SSH logs and automatically bans IP addresses after repeated failed login attempts — an effective defence against brute-force attacks.
  • Restrict access by IP. If your office or home IP is static, configure your firewall (iptables, ufw, or your cloud provider’s security groups) to only allow SSH connections from known IP addresses.
  • Keep OpenSSH updated. Vulnerabilities in SSH server software are rare but serious. Keep the openssh-server package updated as part of your regular patching routine.
⚠️
Don’t Lock Yourself Out

When making SSH security changes on a VPS or dedicated server — particularly disabling password auth or changing the SSH port — always test the new configuration in a second terminal window before closing your existing session. If you lock yourself out of SSH, you’ll need to use your provider’s emergency console access (usually available via your cloud dashboard) to fix the configuration. Testing in parallel takes 30 seconds and prevents a potentially hours-long recovery.

12. SSH Quick Reference

A condensed reference for everything covered in this guide.

Connection Commands

TaskCommand
Basic connectionssh user@hostname
Custom portssh -p 2222 user@hostname
Specific key filessh -i ~/.ssh/keyname user@hostname
Generate key pairssh-keygen -t ed25519 -C "[email protected]"
Copy public key to serverssh-copy-id user@hostname
Upload file to serverscp file.zip user@hostname:~/destination/
Download file from serverscp user@hostname:~/file.sql ./
Sync directory with rsyncrsync -avz ./local/ user@hostname:~/remote/

Getting Started Checklist

  • Confirm your hosting plan includes SSH access — check your control panel or contact support
  • Find your SSH hostname, username, and port in your hosting dashboard
  • Enable SSH access in your control panel if required (cPanel: Security → SSH Access)
  • Generate an SSH key pair with ssh-keygen -t ed25519 on your local machine
  • Upload your public key to the server via your control panel or ssh-copy-id
  • Connect with ssh [email protected] and verify you reach a shell prompt
  • Save your connection details to ~/.ssh/config for a quick alias
  • Check if WP-CLI is available: run wp --info from your site’s root directory
  • If on a VPS, disable password auth and root login once key auth is confirmed working

The Terminal Is Not
Something to Fear

SSH feels intimidating before you’ve used it. A black screen with a blinking cursor, no buttons, no confirmation dialogs — just you and the server. But within a few sessions it stops feeling foreign and starts feeling efficient. Things that take five minutes in a control panel take five seconds in a terminal. Things the control panel can’t do at all become straightforward.

The path is simple: enable SSH on your hosting account, generate a key pair, connect once, and run a few commands. The learning curve is steep for about an hour and then it levels off into genuine capability. Every hosting skill you build after that — running WP-CLI, managing deployments, debugging errors live, migrating databases — becomes faster and more reliable because you have direct access to the server underneath everything else.

The control panel will always be there for convenience. But the real power has always been one command away.

Open a terminal. Type ssh [email protected].
The rest follows naturally.