5

It has been many years now with WordPress 2, WordPress 3 and now even WordPress 4 which is expected to be released shortly that WordPress Publishing Platform does not support SFTP as the option to upload themes, download upgrades and configure plugins?

Many other platforms such as MovableType and ExpressionEngine and Umbraco are also enterprise driven as WordPress has proven itself to be an enterprise product but why does it still not support SFTP?

Regards

1
  • This is the wrong place to ask why wordpress has feature A but not B. The right place is the wordpress IRC channel, mailing list or to suggest the feature at trac. Aug 15, 2014 at 3:14

1 Answer 1

8

WordPress does support making connections using SSH (aka SFTP) via the built in updater system. It got this support in version 2.7, approximately 6 years ago. Reference: https://core.trac.wordpress.org/ticket/7690

If you're not seeing it in the normal "credentials" screen, then this is because your PHP installation lacks the support necessary for it to be able to it. WordPress cannot talk "ssh", but it can use the PHP "ssh2" extension to do it, if that extension is available.

There are two prerequisites for using SSH in WordPress.

  1. First, the PHP installation must have the ssh2 extension loaded or otherwise compiled in. You can get this via pecl if you don't have it available. In some cases, you may need to recompile your PHP or use a custom one if your host doesn't support it. Most don't, which is why you don't see it by default.

  2. Second, the stream_get_contents function must be available. This is usually the case, but on some hosts, it may not be there. Check first. The built in code also checks for both of these, so if they are not available, then it will simply fail the check and you don't get the ssh option.

If you have both of these conditions correct, then the normal connection screen should automatically display some new fields for you. This includes an "SSH2" option, and fields to input paths to a public and private keypair.

Much like the FTP method, you can put in this information every time, if you like, but it's a lot easier to simply set some constants in the wp-config file.

The constants will look like this:

define('FTP_PUBKEY','/home/user/.ssh/public-key-file');
define('FTP_PRIKEY','/home/user/.ssh/private-key-file');
define('FTP_USER','user');
define('FTP_PASS','passphrase');
define('FTP_HOST','domain.com');

The way you do this is to generate a new ssh keypair specifically for WordPress to use. The public and private keypairs should be stored somewhere on your server for WordPress to be able to read them. The private key can be encrypted by a passphrase, which WordPress will need to know. The public key will need to be added to your "authorized_keys" file for your account.

With all this in place, WordPress will read the private key, use it to connect to the hostname with the specified username using that key. Then it will behave much the same as using normal FTP, except over the SSH connection instead.

2
  • 1
    This script will tell you what extensions are needed, installed, and missing for WordPress: github.com/cftp/WP-Extension-Check I've added the ssh2 PHP extension under the desired list
    – Tom J Nowell
    Aug 15, 2014 at 0:54
  • Thanks to the comment @TomJNowell and thanks to otto for the answer. Much appreciated. I have a dedicated server on NGINX environment so I can add these to my PHP setup. Regards Aug 15, 2014 at 18:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.