Help Centre / Developer Tools

Connect Over SFTP

Updated 2 October 2026

SFTP is the direct way into your website’s files. You use it to upload a theme, pull a copy of the uploads folder down to your machine, or edit a file when the WordPress dashboard will not let you.

Every website on your account has its own SFTP account. One site’s details reach that one site and nothing else, because each website runs as its own system user on the server. That is worth knowing if you give a developer a key: you are giving them one site, not your account.

Step 1: Find Your Details

Open the website in the members area at my.oxyforge.com and go to the SFTP tab. Switch SFTP on if it is not already, and you will find:

• Host - the server address to connect to
• User - sf-p- followed by your site’s internal name, cut to 32 characters
• Port - 2222
• Opens in - the folder the session starts in

SFTP here is key-only. There is no password to set or reset: add a public key in the Keys card on the same tab. See add an SSH key.

Step 2: Pick A Client

Any SFTP client works. These three are the ones we suggest.

A plain FTP client will not do. The platform accepts SFTP, which is file transfer over SSH, and that is a different protocol despite the similar name.

Step 3: Connect

In FileZilla, open File then Site Manager, and add a new site:

• Protocol: SFTP - SSH File Transfer Protocol
• Host: the host from the SFTP tab
• Port: 2222
• Logon Type: Key file, pointing at your private key
• User: from the SFTP tab, copied rather than typed

Connect. The first time, your client will show the server’s host key fingerprint and ask you to trust it. Accept it once and it will not ask again.

The session opens in your website’s web root, which is the folder holding wp-config.php, wp-content and the rest of WordPress. One level up you can see the site’s own logs, private and tmp folders, and nothing beyond them. Everything you edit lives under the web root.

Step 4: Know Which Folders Matter

Your Key

A key is better than a password in every way that matters: nothing guessable is sent, and there is nothing to store in your client. Add one in the Keys card on the SFTP tab, then point your client at the matching private key file. See add an SSH key for how to generate one.

The same key serves WP-CLI once it is switched on for the site, so one key covers everything a developer does here.

What SFTP Is Not For

There is no root access and no shell on the server itself. Your SFTP session is confined to your website, and SSH gives you no shell either: a key can only run wp commands, and those run inside your own site’s container as your site’s user. That is deliberate, and it is what keeps one customer’s site away from another’s.

For moving a whole site, SFTP is the slow route. Use a migration plugin instead, which carries the database as well. See move your site with a migration plugin.

Troubleshooting

Connection timed out or refused. The port. Set it to 2222.

Authentication failed. Copy the username from the SFTP tab rather than typing it: it is sf-p- followed by your site’s internal name, cut to 32 characters, and the cut is easy to get wrong by hand. Then check your client is pointing at the private key that matches the public key you added, and that SFTP is switched on for the site.

“Permission denied” writing a file. You are probably outside your web root, or trying to write where WordPress core lives. Check the path.

Changes do not show on the site. The platform runs a full-page cache, so an edited template or stylesheet can keep serving the old version to visitors. Clear the cache from the site’s Tools tab. See clear the cache.

The transfer keeps stalling on a big folder. Lower the number of simultaneous transfers in your client to one or two. Thousands of small files in the uploads folder will go faster that way than in parallel.

The site breaks after an edit. Keep a copy of every file before you change it, or restore from the Backups tab. See restore a backup.