Most failed SFTP logins come from using the wrong protocol, port, username, or server address. Before changing site files, re-copy the SFTP details from your hosting account and test a fresh connection in your SFTP client.
Quick Checks Before You Change Anything
Use an SFTP client such as FileZilla, Cyberduck, Transmit, or WinSCP. WordPress.org’s file transfer documentation explains that FTP/SFTP clients are commonly used to manage WordPress files when dashboard access is not enough: FTP Clients.
Check these settings first:
| Setting | What to use |
|---|---|
| Protocol | SFTP, not FTP or FTPS |
| Port | Usually 22, unless your host lists a custom port |
| Host | The exact SFTP/SSH hostname from your hosting panel |
| Username | The SFTP or SSH username, not always your WordPress admin username |
| Password/key | The SFTP password or SSH private key for that account |
| Remote path | The site’s document root, often public_html, htdocs, www, or a site-specific folder |
Do not keep retrying the same failed login dozens of times. Some hosts temporarily block repeated failed SSH/SFTP attempts.
Fix In The Safest Order
1. Confirm You Are Using SFTP, Not FTP
In your client, choose SFTP – SSH File Transfer Protocol.
A common mistake is entering the right username and password into the wrong protocol. FTP, FTPS, and SFTP are different connection methods. SFTP normally runs through SSH, often on port 22; FTP commonly uses port 21.
If your host gives you a URL such as sftp.example.com, do not paste it into a plain FTP profile unless your client automatically detects SFTP.
2. Re-Copy The Host, Port, And Username From Hosting
Open your hosting control panel and look for SFTP, SSH, Developer Tools, Site Access, or File Transfer.
Copy the values directly from there. Watch for these differences:
example.commay not be the SFTP host.- The SFTP username may differ from the WordPress admin username.
- Managed WordPress hosts often generate separate SFTP accounts per site.
- Staging and production sites may have different SFTP credentials.
- Some hosts require a custom port instead of
22.
If you recently changed your hosting password, that does not always update SFTP credentials. Reset the SFTP/SSH password from the host panel if the option is available.
3. Check Password Versus SSH Key Login
Some hosts allow password login. Others require an SSH key.
If your host expects an SSH key, make sure your SFTP client is using the matching private key. In FileZilla, WordPress.org’s FileZilla guide covers connecting and troubleshooting at a client level: Using FileZilla.
Useful checks:
- The public key must be added in the hosting account.
- The private key must be selected in your SFTP client.
- The key may need a passphrase if you created one.
- The username still matters even when using a key.
If the client says the password is wrong but you are using key authentication, remove any saved password from the profile and configure the key explicitly.
4. Handle Host Key Warnings Carefully
The first time you connect to a server, your SFTP client may ask whether to trust the host key. That is normal for a new connection.
Be more cautious if the warning says the server key changed. That can happen after a host migration or server rebuild, but it can also mean you are connecting to the wrong destination.
Before accepting a changed key:
- Confirm the SFTP hostname in your hosting panel.
- Check whether your host recently migrated the site.
- Ask hosting support to verify the current SSH/SFTP fingerprint if you are unsure.
Do not delete saved host keys just to silence the warning unless you have confirmed the server identity.
5. Rule Out IP Blocks And Firewall Problems
If the same credentials work from one network but fail from another, the problem is probably not WordPress. It is more likely a firewall, blocked IP address, VPN route, office network rule, or hosting security setting.
Try this:
- Turn off VPN temporarily and reconnect.
- Try another network, such as a mobile hotspot.
- Check your hosting firewall or security panel for blocked IPs.
- Ask your host whether SSH/SFTP is enabled for your plan and account.
If the error is Connection timed out, No route to host, or Connection refused, credentials may not be the issue. Those messages usually point to the host, port, network, or firewall.
If You Can Connect But Cannot Find WordPress
A successful SFTP login does not always open directly inside the WordPress folder.
Look for one of these directories:
public_htmlhtdocswwwhtmlapps- a folder named after the domain or site
You are in the right place when you can see typical WordPress files and folders such as:
wp-admin
wp-content
wp-includes
wp-config.phpIf you manage multiple sites, do not edit files until you confirm the domain path. Open wp-content/themes or wp-content/plugins only after you are sure you are inside the correct site folder.
When The Login Works But Uploads Fail
A connection can succeed while uploads, deletes, or edits fail. That usually means the SFTP account can read files but does not have write permission for that folder.
Before changing permissions broadly:
- Try uploading a harmless test file to
wp-content/uploads. - Check whether the target folder belongs to a different system user.
- Use the host file manager to compare ownership and permissions.
- Contact hosting support if the account cannot write to its own site directory.
Avoid setting folders to 777. That is rarely needed and can create a security problem.
Optional SSH Check
If your host provides SSH access, you can confirm whether the SFTP account reaches the server at all:
ssh [email protected] -p 22Replace the username, host, and port with the values from your hosting panel.
If SSH fails with the same credential or network error, fix that first. SFTP depends on the same access path on many hosts.
How To Confirm The Fix Worked
The connection is fixed when your SFTP client can log in, list the site files, and open the correct WordPress directory.
Before editing anything important:
- Download a backup copy of the file you plan to change.
- Make one small change at a time.
- Re-upload only the intended file.
- Check the site in a browser.
- Keep the SFTP client open until you confirm the site still loads.
If the goal is to recover from a broken plugin or theme, rename only that specific plugin or theme folder inside wp-content. Do not rename core WordPress folders such as wp-admin or wp-includes.
Roll Back Or Escalate
Roll back immediately if a file edit causes a new error. Upload the backup copy you downloaded before the change.
Contact hosting support when:
- The host, port, username, and password or key are copied correctly but login still fails.
- The SFTP client reports timeouts or refused connections.
- Your IP appears blocked.
- The host key changed and you cannot verify why.
- You can log in but cannot access the correct site folder.
- File ownership prevents uploads or edits.
Give support the SFTP hostname, port, username, exact error message, and your public IP address. Do not send your password or private SSH key.