SSH

SSH is a secure protocol for remote login and other network services over an unsecured network. At Kinsta, SSH access is included with all Managed WordPress Hosting plans, allowing you to log into the command line, perform administrative tasks, and execute commands as if you were directly on the server. With SSH, you can use essential tools like Git, Composer, and WP-CLI for efficient site management. If you’re on a Single 1.9M or higher plan or a WP 60 or higher plan, you also get access to additional tools like npm.

SSH is recommended for advanced users only, as running incorrect commands can potentially break your site. If you’re unsure or unfamiliar with SSH, we strongly advise consulting a developer or reaching out to our Support team before making any changes.

Primary SFTP/SSH user

You can connect to SSH using the following information from the Primary SFTP/SSH user:

• host/server address (IP address)
• username (SFTP Username, not your email address)
• password
• port (we take security seriously here at Kinsta, each environment uses a different port)

You can find this information under the Primary SFTP/SSH user of each site’s Info tab within MyKinsta.

You cannot create additional users to connect via SSH; however, you can create additional SFTP users.

Change the primary SFTP/SSH user password

If you want to update the primary SFTP/SSH user password for the current environment, hover over the password and click Generate new SFTP password.

To confirm the password change, click Generate new password.

Set a password expiration for the primary SFTP/SSH user

If you want the primary STFP/SSH user password to expire and regenerate at regular intervals automatically for the current environment, click the edit icon under Password expiration.

Choose how often you want the password to expire and regenerate, and click Save changes.

Authentication methods for primary SFTP/SSH user

To change the primary SFTP/SSH user authentication methods to enable or disable access with a username and password for the current environment, click the edit icon under Authentication methods.

Select Password to enable or disable SSH access with a username and password, and click Save changes. You cannot disable access using an SSH key; however, you can disable all SFTP/SSH access.

IP allowlist for primary SFTP/SSH user

To specify a list of IP addresses that are allowed to access your environment via SFTP/SSH, click the edit icon under IP allowlist.

Enter the IP addresses you want to allow access via SFTP/SSH and click Add. You can specify multiple addresses separated by a comma, e.g., 1.1.1.1, 2.2.2.2. You can also specify a range of IP addresses using a slash, e.g., 1.1.1.1/32.

Once you have entered all of the required IP addresses, click Update IP allowlist.

How to connect to SSH with a username and password

The easiest method for connecting via SSH is to use a username and password. To connect with a username and password, you must ensure the password authentication method is enabled. The steps to do that vary depending on your operating system. We’ve outlined the process for each below.

• Windows
• Mac or Linux

Connect to SSH with a username and password on Windows

Windows users require a terminal client to connect to SSH. We recommend downloading the free PuTTY client using the .msi installer. This also includes PuTTYgen, which you’ll need if you want to use SSH keys.

1. Launch PuTTY and enter your Host IP Address and the unique Port number (both found in MyKinsta > Sites > sitename > Info > Primary SFTP/SSH user > Host). Then click Open.

   

2. If this is your first time connecting, you will most likely see a rsa2 key prompt. Go ahead and click Yes, which will trust the host in the future.

   

3. In the terminal screen, you’ll need to enter your Kinsta username and press Enter/return.

   

4. You’ll then be prompted to enter your password. Press Enter/return again.

   

You’re now connected via SSH to your WordPress site.

You can run commands such as ls or cd to list items and navigate throughout your site’s directories. WP-CLI is also installed by default on all sites.

Connect to SSH with a username and password on Mac/Linux

On Mac or Linux, it’s a lot easier to connect to SSH because the operating system (OS) already has a terminal built into it.

1. Open the terminal by going to Applications > Utilities and double-clicking on Terminal.
2. Then enter the command like this (You can copy/paste this command directly from MyKinsta):

ssh username@hostip -p portnumber

How to connect to SSH with SSH keys

Another option for connecting to SSH is to generate an SSH key pair. SSH keys provide a more secure way of logging into a server and eliminate the need for a password. You can also further protect your login by adding a passphrase, but this isn’t required.

How to generate SSH key pair on Windows

1. Launch PuTTYgen. If you haven’t downloaded it yet, you can grab it here.
   
2. The default parameters should be fine in most configurations. Click on Generate.

   

3. Move your mouse around to generate some randomness.

   

4. Save both your public (.txt) and private key (.ppk). Important: Keep your private key safe and don’t share it with anyone.

   

5. Leave the PuTTY window open and skip down to where you add your public key to MyKinsta.

How to generate SSH key pair on MAC/Linux

Launch the Terminal from Applications > Utilities > Terminal and use the following command to start the key generation:

ssh-keygen -t rsa

Choose a location to save your private key. If you leave it blank, it will save it here:

/home/youruser/.ssh/id_rsa

The public key (.PUB) will get created in the same location.

/home/youruser/.ssh/id_rsa.pub

You will then be prompted to choose a passphrase. You can leave it empty if you don’t want to use a passphrase.

How to add SSH keys in MyKinsta

Now that you have your SSH keys, you can upload your public key to MyKinsta.

1. Click into your user profile in the top-right corner, and click on User Settings.

   

2. In the My Account tab, click on the Add SSH key button.

   

3. Choose a label and paste your public key.
   • If you’re running Windows, copy and paste the public key directly from PuTTYgen.
   • If you’re running Mac/Linux, you can copy your public key to your clipboard by using the following command in Terminal:

pbcopy < ~/.ssh/id_rsa.pub

4. After you paste your public key, click the Add SSH key button.

   

How to connect to SSH on Windows with SSH keys

1. Launch PuTTY and enter your Host IP Address and the unique Port number (both found in MyKinsta > Sites > sitename > Info > Primary SFTP/SSH user > Host).

   

2. Under Connection > Data enter your Kinsta username in the Auto-login username field.

   

3. Under Connection > SSH > Auth > Credentials, click the Browse button and select your private key file for authentication.

   

4. Under Session, enter a new Saved Sessions name and click on Save. Click the Open button to start a new session.

   

5. You’ll most likely see a security alert about a change in keys. Click on Yes.

   

6. If you set up a passphrase, you’ll need to enter that.

   

   Otherwise, you’ll be logged right in.

   

How to connect to SSH on MAC/Linux with SSH keys

1. Launch the Terminal from Applications > Utilities > Terminal.
2. You now need to load your saved private key using the following command:

ssh-add ~/.ssh/id_rsa

3. If you set a passphrase for your key, you’ll be prompted to enter that.
4. Enter the command in the following form (You can copy/paste this directly from MyKinsta):

ssh username@hostip -p portnumber

Disable/enable SFTP/SSH access

If you want to disable access so users with the primary SFTP/SSH credentials can’t connect via SFTP/SSH, on your site’s Info tab and within Primary SFTP/SSH user, click Disable.

To confirm the changes, click Disable SFTP/SSH access.

When SFTP/SSH access is disabled, the connection details are no longer shown.

If you want to enable access and show the connection details, click Enable > Enable SFTP/SSH access.

Additional notes

If you have trouble connecting, you might need to change the password or delete entries from your known_hosts file.