Securing site only with FTP [duplicate]

Question

I just want to understand something. Our developer, busy with cleaning up malware from our site, asked for SSH access in order to install latest security patches on our magento 1.9.2.4. The hosting won't allow it for security reasons? ok, now I have to know for sure if those patches can be easily installed only by a FTP access or if it is necessary in order to finish the job and secure the site to have SSH. In that case I'll have to move to a different hosting. Developer is not helping a lot in this. Please help as the developer won't finish his job and I'm stuck in my ignorance of the topic and our site down the developer want to be paid for unfinished work carried out and I don't know if he's taking me for a ride or what. Thanks

Answer 1

TL;DR You can't install patches without SSH, but there's a workaround. It's risky to use it.

Normally, Magento patches can not be installed with FTP, they require SSH. A google search for "magento patch ftp" brings up this page, though:

https://magentary.com/kb/install-supee-6788-without-ssh/

You can download the patched files there, and then they can be installed (= uploaded) via FTP. Keep in mind though, that:

• this is no official Magento source, so if you or your developer don't check it manually, you can't be sure that the files you download there are valid and don't include malware
• when you patch a shop using SSH, it automatically checks if the file that will be patched is in its original state (= there has been no modification to the Magento core), and the patch will fail if it is not; this check is not done when you patch with FTP

To secure the site, there may also be some stuff to do regarding file permissions and ownership. Most of these things can be done with FTP, but it's not very convenient and might take more time than with SSH access. Some hosters also provide a tool for this in the administration panel.