Enabling SSH Access on Shared Hosting: What It Can Do and Is It Safe

Many people assume SSH is only for VPS or dedicated server users, but a large number of shared hosting plans support SSH as well. What you get is a restricted form of SSH called a jailed shell, and it is more than enough for the tasks developers reach for most often: unzipping a large archive on the server in seconds, managing WordPress with WP-CLI, installing project dependencies with Composer, or exporting a database with mysqldump. This article explains what SSH on shared hosting actually is, how it differs from FTP, what it can and cannot do, how to connect from every operating system, and answers the key question of whether enabling SSH puts your website at greater risk.

What SSH Means for a Shared Hosting User

SSH (Secure Shell) is a protocol for connecting to and controlling a server remotely over a fully encrypted channel. Once connected, you get a command line where you type commands that execute directly on the remote machine, as if you were sitting in front of the server itself. Everything that travels across the connection — your password, your commands and their output — is encrypted end to end, so it cannot be intercepted in transit.

For a shared hosting user, the most tangible benefit is speed and flexibility when working with files and databases. Jobs that take tens of minutes dragging files one by one over FTP usually finish in a single command over SSH: migrating an entire website, creating a full backup, or updating dozens of WordPress plugins in one go.

How SSH Differs from FTP

Both give you access to your hosting space, but their capabilities are worlds apart. FTP was designed purely to transfer files, and classic FTP sends everything — including your password — unencrypted (you need FTPS for encryption). SSH encrypts everything by default, and beyond transferring files via SFTP or SCP, it lets you type commands that run directly on the server.

If you are already comfortable with FTP, see our FileZilla FTP guide as a companion — FileZilla itself also supports SFTP (file transfer over SSH); you simply switch the protocol in Site Manager.

What SSH on Shared Hosting Can Do (the Jailed Shell)

Shared hosting providers that offer SSH typically grant a jailed shell: you are confined to your own account, cannot see other users' files, and can run only the commands the administrator has whitelisted. Even so, that covers most of what developers actually need day to day:

• File management far faster than FTP — copy, move, rename or delete thousands of files in one command, and fix permissions with chmod.
• Compress and extract archives on the server — unzip and tar turn a site migration or a large theme install into a few seconds of work instead of uploading tens of thousands of individual files.
• WP-CLI — full WordPress management from the command line: update core, plugins and themes, create users, reset passwords, or search-replace URLs in the database (see our WP-CLI guide).
• Composer — install PHP project dependencies, for example Laravel packages, inside your project folder (more in using Composer on hosting).
• Git — clone or pull code from GitHub or GitLab straight onto the server and build a git-based deployment workflow (see the Git and CI/CD guide).
• rsync — synchronize files between your local machine and the server transferring only the differences; ideal for repeated deployments and backups.
• mysqldump / mysql — export and import large databases far more reliably than phpMyAdmin, which often hits timeouts on big files.

The Limits of SSH on Shared Hosting

The crucial thing to understand is that SSH on shared hosting is not root access. Your privileges are those of one ordinary user on a machine shared with other customers. The main limitations are:

• No root privileges — sudo, apt install and yum install are refused; you cannot install or upgrade system-level software.
• No server-level configuration — Apache and PHP tuning is limited to what .htaccess and per-account PHP settings allow.
• No long-running processes — daemons, bots or Node.js servers that must run continuously are usually terminated automatically by the resource manager.
• Resource limits apply — CPU, RAM and the number of processes per account are capped so one customer cannot degrade the experience of others; very heavy jobs may be killed.
• Some commands are disabled — administrators may restrict the available command set according to each provider's security policy.

If your work keeps bumping into these limits, that is the signal to consider a VPS, which gives you full root access.

How to Connect via SSH from macOS, Linux and Windows

macOS / Linux

Open the built-in Terminal app and type:

ssh [email protected]
# if the server uses a port other than 22
ssh -p 2222 [email protected]

The first time you connect, you will be asked to confirm the server's fingerprint. Type yes, then enter your password (or, if you have set up an SSH key, you will be logged in immediately).

Windows

Windows 10 and later ship with a built-in OpenSSH client. Open Windows Terminal or PowerShell and use the same ssh command as on macOS/Linux. If you prefer a graphical tool, use PuTTY: enter the hostname and port, click Open, then log in with your hosting account username and password.

Your host, username and port are normally listed in your welcome email or in your control panel — for AsiaGB that is DirectAdmin. If you are not sure whether SSH is enabled on your account, simply ask via a support ticket.

SSH Keys vs Passwords: Which Is Safer

Password login is convenient but has weaknesses: passwords can be guessed, brute-forced or phished. The safer alternative is SSH key authentication, which uses a cryptographic key pair — the public key is stored on the server while the private key stays on your machine and is never transmitted over the network, making it practically impossible to intercept or guess.

The recommended practice is to generate a key with ssh-keygen -t ed25519, protect the private key with a passphrase, and add the public key to the server. AsiaGB users can add keys themselves in DirectAdmin — for detailed steps covering key generation on every OS and fixing Permission denied errors, read How to Use SSH Keys in DirectAdmin.

Essential Everyday Commands with Examples

If you are new to the command line, the set below covers almost all routine tasks:

# where am I, and what files are here?
pwd
ls -lah

# move into the web folder (path depends on the provider)
cd ~/domains/yourdomain.com/public_html

# extract an uploaded zip archive
unzip website-backup.zip

# compress a whole folder for backup
tar -czf backup-2026-07-17.tar.gz public_html/

# export a database
mysqldump -u dbuser -p dbname > backup.sql

# update every WordPress plugin with WP-CLI
wp plugin update --all

# see how much space each folder uses
du -sh */

Security: Is a Jailed Shell Safe, and Best Practices

The question we hear most often is whether enabling SSH makes a website more vulnerable. The short answer is no — managed properly, SSH is actually safer than classic FTP, because every byte of the session is encrypted. The jailed shell itself is designed to contain damage: each account is confined to its own boundary, sees only its own files, and can run only permitted commands. Even if one account were compromised, the impact is contained rather than spreading across the whole machine easily.

The real risk usually comes from the user side, not the protocol. Follow these practices:

• Use SSH keys instead of passwords, and always set a passphrase on the private key.
• If you must use a password, make it long and unique to this service.
• Keep private keys only on trusted machines; never store them in unencrypted cloud storage or share them with anyone.
• Remove keys belonging to old machines or former team members from the server immediately.
• Log out (exit) when finished, especially on shared computers.
• Never run scripts copied from the internet without reading them first — your user privileges are enough to delete every file of your own website.

When to Upgrade to a VPS for Full Root Access

A jailed shell is plenty for typical websites and most development work, but if you find yourself in any of the situations below, a VPS is the better fit:

• You need system-level software such as Redis, a specific Node.js version, ffmpeg or special libraries.
• You need processes running around the clock: application servers, queue workers, bots.
• You need to tune the web server, PHP or firewall at the configuration level yourself.
• You keep hitting the CPU/RAM ceiling of shared hosting and jobs get cut off.

AsiaGB Linux VPS starts at 500 THB/month with full root access on SSD storage and 99% uptime, with a choice of Thailand or Singapore datacenters. If you are about to use SSH on a VPS for the first time, continue with our beginner's guide to SSH on a VPS.

Frequently Asked Questions (FAQ)

Do all shared hosting providers enable SSH automatically?

No. SSH policies vary between providers: some enable it only on certain plans, while others require you to contact support to switch it on per account. AsiaGB customers should open a ticket at billing.in.th/submitticket.php to ask about and request SSH access.

Can I install system-level software over SSH on shared hosting?

No. Without root privileges, commands such as apt install or yum install are refused. You can only use tools that are already installed — WP-CLI, Composer, Git — and install project-level dependencies inside your own folders. Installing system software requires a VPS.

What is a jailed shell?

A restricted shell environment where you can only see and modify files within your own account, cannot view other users on the same server, and can run only the commands the administrator allows. It is the standard security model for shared hosting that offers SSH.

How is SSH different from FTP?

FTP only transfers files, and classic FTP sends data including passwords unencrypted. SSH encrypts everything by default and lets you run commands directly on the server — unzip archives, run WP-CLI, export a database with mysqldump — none of which FTP can do.

Does enabling SSH make my website easier to hack?

No. Configured properly, SSH encrypts the whole connection and is safer than plain FTP. The real risks are weak passwords or leaked private keys. Use SSH key authentication, protect the key with a passphrase, and never share it.

How are SFTP and SSH related?

SFTP is file transfer running over the SSH connection — same port, same authentication. So if your account has SSH, you can usually use SFTP right away in a client like FileZilla by selecting the SFTP protocol instead of FTP.

When should I upgrade from shared hosting to a VPS?

When you need full root access — to install system software, tune the web server yourself, or run long-lived processes — or when your workload keeps hitting shared hosting resource limits. AsiaGB Linux VPS starts at 500 THB/month with full root access.