Skip to main content
Every OrbitLab project includes SFTP (Secure File Transfer Protocol) access to its files, whether it’s a Managed WordPress site, a PHP site, or an app deployed from Git.

​
What you can access

  • Managed WordPress and PHP sites: your site’s files (for WordPress, wp-content, wp-config.php, and so on).
  • Apps: your app’s persistent storage, mounted at /app/data inside your container. See Persistent storage. The rest of the container filesystem is rebuilt on every deploy and isn’t accessible over SFTP.

​
Finding your credentials

Your SFTP credentials are generated automatically when your project is created.
  1. Go to your Dashboard.
  2. Open your service.
  3. Find the SFTP file access card.
  4. You’ll see your Host (for example ftp.europe-1.orbitlab.dev), Port (2022), Username, and Password.
Only organization owners and admins can see the password. Other members still get the host, port, and username, and can use the file manager.

​
Using the file manager

From the SFTP file access card, open the file manager to browse folders, view text files, download files, upload files, and create folders directly in your browser, with no SFTP client needed.

​
Connecting with an SFTP client

You can use any standard SFTP client. Make sure to set the port to 2022.
  • FileZilla: Open Site Manager, create a new site, set Protocol to “SFTP”, and enter your credentials.
  • WinSCP: Select “SFTP” as the file protocol and enter your host and login details.
  • Cyberduck: Click “Open Connection” and select “SFTP”.
SFTP access uses your username and password; SSH key authentication isn’t supported.
If uploads or new folders are refused on an app created before SFTP was available for apps, redeploy the app once to fix the storage permissions.

​
Security best practices

  • Limit access: Only share SFTP credentials with trusted developers.
  • Keep secrets out of shared folders: Anyone with SFTP access can read every file in your project’s storage.