SSH, SFTP and WP-CLI often appear together in WordPress hosting plans, but they are not three names for the same kind of access. SSH provides a remote command-line session. SFTP transfers files over the SSH transport. WP-CLI is a WordPress management tool that can be run from the command line.
SSH is the connection and shell. SFTP is file transfer. WP-CLI is a WordPress administration tool.
The three tools at a glance
SSH: a secure command-line session
SSH lets a developer work through a shell rather than a graphical control panel. From an appropriately scoped account, that can make tasks such as inspecting logs, checking files, running Git commands or invoking WP-CLI considerably faster.
SSH access does not inherently mean root access. A hosting platform can provide a shell whose filesystem permissions and available commands are limited to a particular site. For normal WordPress development, that is usually a better boundary than granting operating-system administration privileges.
SFTP: secure file transfer
SFTP uses the SSH transport but presents a file-transfer workflow. It is useful when you want to work with site files through an SFTP client rather than an interactive shell.
Typical tasks include downloading a log or configuration file, uploading a theme asset, inspecting a directory tree or transferring a file that is not being deployed through Git.
SFTP should not be confused with traditional FTP. SFTP is part of the SSH ecosystem and encrypts the connection.
WP-CLI: WordPress from the command line
WP-CLI operates at the WordPress application layer. It understands WordPress concepts such as plugins, themes, users, options, transients, the database and core updates.
Examples of useful operations include listing plugin status, checking the WordPress version, searching and replacing URLs during a migration, flushing application caches, exporting a database or reading a WordPress option.
Because WP-CLI loads WordPress, the PHP runtime and application state still matter. A command can fail because of a broken plugin or application error even when the SSH session itself is working perfectly.
How the tools fit together
A developer may therefore connect over SSH and then run WP-CLI, while another developer uses an SFTP client with the same site-scoped credentials without opening an interactive shell.
Why site-scoped access matters
On managed multi-site infrastructure, a WordPress developer normally needs control over the site rather than control over the hosting node. Those are different permissions.
A site-scoped account can expose the site’s public files, logs and appropriate tooling while preventing access to other customer sites and protected platform internals. This preserves a useful developer workflow without turning every hosting user into a Linux administrator.
The same principle appears in the shared versus dedicated hosting guide: strong isolation is about well-defined boundaries, not simply whether hardware is shared.
Password versus SSH key authentication
SSH keys allow a client to authenticate using a cryptographic key pair rather than sending a reusable account password. The private key stays with the developer; the corresponding public key is authorised on the service.
Keys are particularly useful for development machines and automated deployment workflows because individual keys can be added and revoked without sharing one common password between people or systems.
Where Git fits
Git is not a replacement for SSH, SFTP or WP-CLI. It is a source-control and deployment workflow. A Git repository may itself be accessed over SSH, and a developer can run Git commands from an SSH shell, but the repository and the site shell remain separate security contexts.
For repeatable code changes, Git deployment is generally preferable to manually copying modified theme or plugin files. SFTP remains useful for ad-hoc file operations, while WP-CLI handles WordPress-aware tasks that source control does not.
Common misconceptions
“SSH access means I can sudo.”
No. SSH describes how you establish the session. The permissions inside that session are determined by the account and platform.
“SFTP is just FTP on another port.”
No. SFTP is a different protocol operating over SSH.
“WP-CLI bypasses WordPress.”
No. WP-CLI is specifically designed to operate WordPress. Many commands bootstrap the application and therefore encounter the same plugin, theme and configuration environment as the site.
“If I have SFTP, I do not need Git.”
You can edit a site without Git, but source control provides history, review and repeatability that manual file transfer does not.
How Webcore approaches developer access
Webcore exposes developer tooling at the site boundary. Site-scoped SSH and SFTP provide controlled filesystem and command-line access, while WP-CLI makes WordPress management available without requiring node-level administration. Git deployment provides a repeatable route for code managed in source control.
See WordPress for Developers & Agencies for the development workflow, the staging guide for safe change environments, or Webcore Panel for the management platform.