{"id":41630,"date":"2026-08-25T15:42:31","date_gmt":"2026-08-25T15:42:31","guid":{"rendered":"https:\/\/make.wordpress.org\/meta\/?post_type=handbook&p=41630"},"modified":"2026-08-25T15:42:32","modified_gmt":"2026-08-25T15:42:32","slug":"connecting","status":"publish","type":"handbook","link":"https:\/\/make.wordpress.org\/meta\/handbook\/tutorials-guides\/wordpress-org-sandboxes\/connecting\/","title":{"rendered":"Connecting to your sandbox"},"content":{"rendered":"

Once your access request<\/a> is approved you will have a sandbox hostname and a username.<\/p>\n\n\n\n

SSHSSH<\/span> Secure SHell - a protocol for securely connecting to a remote system in addition to or in place of a password.<\/span><\/span><\/span><\/h2>\n\n\n\n

Add a blockBlock<\/span> Block is the abstract term used to describe units of markup that, composed together, form the content or layout of a webpage using the WordPress editor. The idea combines concepts of what in the past may have achieved with shortcodes, custom HTML, and embed discovery into a single consistent API and user experience.<\/span><\/span><\/span> like this to ~\/.ssh\/config<\/code> so you do not have to retype the details:<\/p>\n\n\n\n

Host wporgsandbox\n\tHostName <your-sandbox-hostname>\n\tUser <your-sandbox-username>\n\tForwardAgent yes\n\tIdentitiesOnly yes\n\tIdentityFile ~\/.ssh\/id_ed25519<\/code><\/pre>\n\n\n\n
Replace the placeholders with the values from your access grant, and point IdentityFile<\/code> at the key you supplied when you requested access. Then:<\/p>\n\n\n\n
ssh wporgsandbox<\/code><\/pre>\n\n\n\n
ForwardAgent yes<\/code> forwards your local SSH agent to the sandbox, which is what lets you push to GitHubGitHub<\/span> GitHub is a website that offers online implementation of git repositories that can easily be shared, copied and modified by other developers. Public repositories are free to host, private repositories require a paid subscription. GitHub introduced the concept of the \u2018pull request\u2019 where code changes done in branches by contributors can be reviewed and discussed before being merged by the repository owner. https:\/\/github.com\/<\/a><\/span><\/span><\/span> from there without copying a private key onto a shared server. Do not copy your private key to the sandbox.<\/strong><\/p>\n\n\n\n
Where things live<\/h2>\n\n\n\n
Path<\/th>What it is<\/th><\/tr><\/thead>
\/home\/<your-username><\/code><\/td>Your sandbox home directory<\/td><\/tr>
\/home\/wporg\/public_html<\/code><\/td>The WordPress.orgWordPress.org<\/span> The community site where WordPress code is created and shared by the users. This is where you can download the source code for WordPress core, plugins and themes as well as the central location for community conversations and organization.  https:\/\/wordpress.org\/<\/a><\/span><\/span><\/span> web root<\/td><\/tr>
\/home\/wordcamp\/public_html<\/code><\/td>The WordCamp.org web root<\/td><\/tr>
\/home\/buddypress\/public_html<\/code><\/td>BuddyPress-hosted sites, including profiles.wordpress.org<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
Viewing your sandbox in a browser<\/h2>\n\n\n\n
You do not need a proxy or a VPN for this. What you do need is for the WordPress.org domains to resolve to your sandbox instead of to production. Requesting the sandbox address directly returns a 403, because nothing tells the server which site you are asking for.<\/p>\n\n\n\n
Add the sandbox address supplied with your access grant to \/etc\/hosts<\/code>, one line per domain you need:<\/p>\n\n\n\n
<your-sandbox-address>\twordpress.org\n<your-sandbox-address>\twww.wordpress.org\n<your-sandbox-address>\tplugins.wordpress.org\n<your-sandbox-address>\tthemes.wordpress.org\n<your-sandbox-address>\ttranslate.wordpress.org\n<your-sandbox-address>\tmake.wordpress.org<\/code><\/pre>\n\n\n\n
Add only the domains you are actually working on. Every line you add is a domain your browser can no longer reach in production.<\/p>\n\n\n\n
These entries stay active until you remove them. If WordPress.org starts behaving strangely in your browser days later, check \/etc\/hosts<\/code> before you check anything else.<\/p>\n\n\n\n
Testing from the command line<\/h3>\n\n\n\n
curl<\/code> can override DNSDNS<\/span> DNS is an acronym for Domain Name System - how you assign a human readable address to a website\u2019s exact numeric coded location (ie. wordpress.org uses the actual IP address 198.143.164.252).<\/span><\/span><\/span> for a single request, which avoids editing \/etc\/hosts<\/code> at all:<\/p>\n\n\n\n
curl --resolve wordpress.org:443:<your-sandbox-address> https:\/\/wordpress.org\/<\/code><\/pre>\n\n\n\n
Add --insecure<\/code> if the sandbox presents a certificate that does not match the domain.<\/p>\n\n\n\n
De-sandboxing<\/h2>\n\n\n\n
Some operations must not run against a sandbox \u2014 most notably anything that uploads media. When you need to act as a normal user again, de-sandbox yourself before continuing. See Working on a sandbox<\/a>.<\/p>\n