Bluehost Starter SSH & SFTP: Port 22, Main User—and the Access Catch

SSH must be enabled on shared hosting

Bluehost's current SSH guide says shared-hosting users enable SSH/Shell access from the Portal. That is different from VPS/Dedicated, where server-level administration can include root.

For Starter, think "account shell," not "full server control." Shell access is useful for commands, file operations, WP-CLI and Git workflows, but it does not turn shared hosting into a VPS.

SFTP uses port 22 and the main account username

Bluehost's SFTP guide says shared hosting uses port 22 and the account/cPanel username after SSH is enabled.

This is easy to configure in FileZilla, Cyberduck or an IDE, but it also means the main account credential has broad file access. Prefer SSH keys where possible instead of repeatedly sharing a password.

Extra FTP users are not separate SFTP users

Bluehost explicitly says additional FTP users created in the control panel cannot connect with SFTP on shared hosting.

That matters for agencies. Creating a narrow FTP account for a contractor does not give them an equivalent narrow SFTP shell identity. If the contractor needs encrypted shell/file access, decide whether sharing the main account is acceptable—or whether the hosting model needs stronger user isolation.

SSH keys are the cleaner long-term authentication path

Bluehost's 2026 SSH management UI lets users add and manage SSH keys. cPanel likewise supports key authorization and deauthorization.

Give each machine or deployment process its own key where practical. Remove keys after a contractor leaves or an automation is retired. Do not store private keys in the web root.

WP-CLI and Git can share the SSH path

WP-CLI supports remote commands over SSH with explicit user, host, port and WordPress path parameters. That makes Starter workable for remote updates, cache flushes or maintenance scripts when WP-CLI is available.

For a private GitHub repository, deploy keys can give the server access to one repository and are read-only by default. GitHub also recommends testing the SSH connection after key setup.

A repository-scoped deployment key is usually easier to revoke than a developer's personal all-repository credential. Test the actual path and permissions before depending on production automation.

When Starter has reached its access boundary

If you need multiple isolated Linux users, root access, custom system packages, daemon configuration, privileged ports or server-level firewall changes, shared Starter is no longer the right control model.

Do not confuse "SSH available" with "server administration available."

Buying decision

Choose Bluehost Starter when you need shared-hosting SSH/SFTP, WP-CLI or Git-style deployment and the main-account access model is acceptable. Choose a VPS or another isolated platform when separate shell identities and server-level control are real requirements.

Affiliate disclosure: Toolnavia may earn a commission from an eligible Bluehost purchase. That does not change the developer-access analysis.