WordPress.com announced in its changelog on November 13, 2026 that SFTP, SSH, WP-CLI, Git commands and GitHub deployments are no longer reserved for the Business and Commerce plans. According to the announcement, the tools are available on every paid plan, including Personal and Premium.
This affects everyone who has their site hosted at WordPress.com and previously had to switch to a higher plan to use the command line. Free sites remain excluded, as the support page explicitly states.
The support page on SSH lists Personal, Premium, Business and Commerce as plans with SSH access and ties it to sites on which plugins are activated. WP-CLI is preinstalled there as soon as you have connected. Your home directory is intended only for work on the command line: WordPress does not read it when it serves the site, and the WordPress.com backups do not include it.
SSH and Git: Changelog and pricing page
Information from WordPress.com, pricing page checked on November 15, 2026
Changelog: every paid plan
- SFTP or SSH
- WP-CLI and Git commands
- GitHub deployments
Pricing page: Business and Commerce
- SFTP/SSH and WP-CLI in the FAQ
- Git commands and GitHub Deployments
- Personal and Premium not mentioned
WordPress.com does not say which information applies
Sources: WordPress.com Changelog, WordPress.com pricing page
The pricing page partly contradicts the changelog. The pricing page FAQ lists SFTP/SSH, WP-CLI, Git commands and GitHub deployments only for Business and Commerce; it says nothing about Personal and Premium. The page lists prices in US dollars and gives no euro price. WordPress.com does not say which information applies.
How do you enable SSH?
The support page describes the steps in the hosting dashboard. The menu names are given there in English; whether the German interface translates them is not clear from the page.
- Open the hosting dashboard and click on the title of your site.
- In the left sidebar, select “Settings” and then “SFTP/SSH”.
- Click “Create credentials” and store the password securely. “Reset password” generates a new one; there is a one-minute wait between two resets.
- Turn on “Enable SSH access to this site”. The dashboard then shows the connection command.
The username and password apply equally to SFTP and SSH. Instead of the password, you can store an SSH key; up to ten are possible per account, and RSA, ECDSA and Ed25519 are supported. On Windows you need WSL (Windows Subsystem for Linux), the OpenSSH client or PuTTY with the server ssh.wp.com on port 22.
What changes for AI assistants and migrations?
In the same changelog, WordPress.com expands the permissions you can grant ChatGPT or Claude for your site. Connected assistants can now, among other things, list SSH keys, provision GitHub repositories, change PHP and WordPress versions, read server logs and delete or reset a site. What an assistant is allowed to do is set in the MCP settings of your account, through which you connect AI assistants.
There is also the migration service at wordpress.com/move. You enter the address of your Wix or Squarespace site, choose a paid plan, and WordPress.com migrates the site in the background. If the migration fails, WordPress.com refunds the full amount, according to the post from November 12. The service is intended for small sites made up of text and images.
What this means for you
First, check in the hosting dashboard whether the “SFTP/SSH” item appears under “Settings”. If it is missing, do not switch plans solely for the command line as long as the changelog and pricing page contradict each other. Better to ask support.
With SSH access you can rescue a site whose dashboard no longer loads: the WP-CLI command wp plugin deactivate switches off a defective plugin. Practice the procedure beforehand on a test site so that you are not working in the terminal for the first time in an emergency.
Also check in the MCP settings what your connected assistants are allowed to do. Deleting and resetting have been part of that since this update. Never put credentials as a .txt or .json file in the site folder, because the support page warns that anyone who knows the address can download them. It is better to store them as constants in the configuration file wp-config.php.
WordPress.com published the changelog on November 13, 2026.
Sources
