Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more

If WordPress suddenly asks for FTP credentials while installing a plugin, updating a theme, or applying a core update, it usually cannot write files through PHP’s direct filesystem method. Start by testing FS_METHOD set to direct, then correct the web server user’s ownership or write access if direct mode still fails. If the host requires a separate transport, configure the appropriate FTP or SSH constants in wp-config.php and remove the override when it does not solve the problem.

What the FTP prompt means

WordPress does not normally need an FTP login for routine updates. It first tries to modify files through PHP’s own file-access functions, a transport WordPress calls direct. When PHP cannot create, replace, or delete files in the WordPress installation, WordPress falls back to other transports and may display a form asking for an FTP or SSH host, username, password, and connection type.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

The prompt is therefore a filesystem-access symptom, not proof that your FTP server is down. A server can accept ordinary FTP connections while the PHP process that runs WordPress is still unable to write to the site directory. Conversely, entering valid credentials will not help if the path is wrong, the account is jailed outside the WordPress directory, or the web server user lacks permission to use that account’s files.

The official WordPress configuration supports four values for FS_METHOD:

#1 Best Overall
Sale
Compressed Air Duster,130000RPM Super Power Cordless Air Duster,Rechargeable Brushless Blower,3 Gear Adjustable Blower with LED Light,Dust Remover for Computer/House/Outdoor/Car
  • Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
  • With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
  • Wide Application:Upgraded attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
  • Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
  • Warranty & Support: Our Electric air duster comes with 5 years warranty and 24/7 customer service. During this period, if you have any questions,pls kindly feel free to contact us.
Method How it works Required PHP capability Typical use
direct PHP reads and writes the files itself None beyond normal filesystem access Preferred first test when the web user owns or can write the files
ssh2 WordPress connects over SSH, normally using a password or key SSH2 PHP extension Hosts that require SSH/SFTP-style administration
ftpext WordPress uses PHP’s FTP extension FTP PHP extension FTP accounts on servers where the extension is enabled and working
ftpsockets WordPress uses PHP sockets to speak FTP PHP sockets class A fallback when the FTP extension is unavailable or malfunctioning

Unless you explicitly set a method, WordPress tries transports in this order: direct, SSH2, the FTP extension, and FTP sockets. Changing FS_METHOD changes that selection; it does not repair ownership, permissions, a missing extension, or an incorrect FTP path.

Use this order to diagnose the failure

  1. Back up the database and files, and make sure you can restore wp-config.php.
  2. Test FS_METHOD with direct.
  3. If direct mode fails, have the host correct ownership and write access for the web server user.
  4. If the host requires a separate account, configure FTP or SSH details and test the correct WordPress root path.
  5. Try ftpsockets when the PHP FTP extension is broken, or use ssh2 when SSH keys are the supported route.
  6. Run one controlled plugin, theme, or core update, then remove any temporary override that did not help.

Do not change several variables at once. Testing one method at a time makes the error message useful and avoids leaving a password or an unsafe workaround in production.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Before editing wp-config.php

Make a recoverable backup

Download a copy of wp-config.php and, if possible, take a hosting snapshot. A syntax error in this file can take the site offline. Keep the original file outside the public web root or in your password manager rather than uploading a second copy with a name that a browser could request.

Find the correct file

wp-config.php is normally in the directory that contains wp-admin, wp-includes, and wp-content. On some installations it is one directory above the web root. Edit the file with the host’s file manager, SSH, or an FTP client; do not use the WordPress dashboard if updates are already failing.

Preserve the file’s structure

Add constants before the line that says /* That's all, stop editing! Happy publishing. */ (the wording can vary slightly by WordPress version). Define each constant only once. A later definition may be ignored or produce confusing results, depending on how the file was edited.

Rank #2
EVEO® Screen Cleaner Spray Kit (Streak-Free) TV Screen Cleaner for Smart TV, Lcd, LEd, Oled | Computer Screen Cleaner Spray and Wipe Microfiber Cloth - TV, Monitor, Laptop, iPad, Car - 6.7oz 1 Pack
  • Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
  • Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
  • Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
  • Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
  • Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth

Step 1: Test the direct filesystem method

Add this line above the stop-editing comment:

define('FS_METHOD', 'direct');

Save the file, sign in again, and retry the exact operation that produced the prompt. If the update completes, the original problem was probably WordPress choosing a transport unnecessarily or a host configuration that now permits the web user to write. Test one more small update, such as a minor plugin update, rather than assuming a single successful screen load proves the issue is gone.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

If the update still fails, do not keep adding FTP credentials blindly. Direct mode does not grant access. The PHP process must have write access to the directories and files it needs to replace, and the files must be owned or mapped in a way the hosting service permits. Ask the host to check the web server user, ownership, ACLs, read-only mounts, disk quota, and security controls such as a malware scanner or mandatory access policy.

The official guidance treats an FS_METHOD override as a troubleshooting measure. Remove the line or restore the previous configuration if it does not help; leaving an ineffective override can hide the host’s normal transport detection.

Step 2: Fix ownership and write access

Ownership is a common reason that direct mode fails. For example, files uploaded through a separate administrative account may belong to that account while PHP runs as a different web user. The web process can then read WordPress but cannot replace a plugin or create a temporary update directory.

  • Ask hosting support which user runs PHP for this site and which user should own the WordPress files.
  • Have support inspect the specific path shown in the error, including wp-content, plugin and theme directories, and the temporary directory used during updates.
  • Check available disk space and inode limits; a full filesystem can look like a permission failure.
  • Check whether a read-only deployment, container volume, or security policy intentionally blocks writes.
  • Use the host’s documented permission and ownership procedure. Do not apply a blanket permission change copied from an unrelated server.

Never “fix” this by making the entire installation world-writable. Broad write access increases the impact of a compromised process and is not a substitute for correct ownership. Permission values differ by operating system, PHP handler, deployment model, and host; use the provider’s instructions or have its administrators make the change.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Rank #3
BladeHawks RGB Gaming Mouse Pad Extra Large Extended 31.5x12 Inch-Black
  • 【Large size】:Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
  • 【LED backlight mouse pad】:Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
  • 【Anti-slip rubber base】:Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
  • 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
  • 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.

Step 3: Supply FTP connection details when direct mode is not possible

If the hosting design intentionally separates the web user from the file owner, WordPress can use an FTP account. Add only the constants you need, above the stop-editing comment:

define('FS_METHOD', 'ftpext');
define('FTP_HOST', 'ftp.example.com');
define('FTP_USER', 'your_ftp_username');
define('FTP_PASS', 'your_ftp_password');

FTP_HOST accepts a hostname and, when required, a port. FTP normally uses port 21; SSH normally uses port 22. Some hosts specifically require localhost as the FTP host for updates. The official sample configuration notes that using the local host can avoid a 503 error on certain plugin or core updates, but this is host-specific rather than a universal setting.

Use the exact account and directory supplied by the host. A control-panel login may not be an FTP login, and an account restricted to a subdirectory may not be able to reach the directory containing wp-admin. Test the same credentials in an FTP client first, using the host’s required encryption mode and port. A successful client login confirms the account, not that WordPress is using the right path.

Keep the password out of support tickets, screenshots, shell history, and version control. Because these values are stored in wp-config.php, protect that file with the host’s normal filesystem and web-server controls. Rotate the password after troubleshooting if it was shared or logged.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Step 4: Use SSH2 and keys instead of an FTP password

When the host provides SSH access and the SSH2 PHP extension is enabled, WordPress can use the ssh2 method. A key-based configuration looks like this:

Rank #4
Sale
Vaydeer Wrist Rest for Keyboard and Mouse, Computer Ergonomic Wrist Support Pad, Soft Memory Foam Arm Cushion for Desk, Palm Hand Office Laptop Typing
  • 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
  • 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
  • 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
  • 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
  • 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
define('FS_METHOD', 'ssh2');
define('FTP_HOST', 'ssh.example.com');
define('FTP_USER', 'deploy_user');
define('FTP_PUBKEY', '/full/path/to/id_rsa.pub');
define('FTP_PRIKEY', '/full/path/to/id_rsa');

The key constants must contain full server-side paths to the public and private key files. With public-key authentication, FTP_PASS can be omitted. The private key must be readable by the PHP process but not exposed through the web. If the key is encrypted with a passphrase and the host’s integration does not support prompting, ask the host which key format and authentication flow it supports.

SSH2 is not the same as plain FTP secured with TLS. WordPress calls the latter FTPS; it enables it with:

define('FTP_SSL', true);

FTP_SSL requests encrypted plain FTP (FTPS). It does not turn FTP into SFTP and does not replace the SSH2 extension. Confirm the protocol, port, and certificate requirements with the host before selecting a method.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Step 5: Choose the correct FTP transport

When to use ftpext

Use ftpext when the PHP FTP extension is installed and the host supports it. If WordPress reports that the extension is missing or the connection fails despite known-good credentials, ask support to verify that the extension is enabled for the PHP version and handler serving this site. A command-line PHP installation can have a different set of extensions from the PHP process used by the web server.

When to use ftpsockets

The official WordPress guide identifies ftpsockets as a known workaround when the PHP FTP extension is broken. Configure it with the same host, user, password, and path values:

Best Value
Sale
Under Desk Cable Management Tray No Drill, Metal Mesh Cable Management Under Desk with Clamp Mount, 2 Hole Cable Tray with Wire Management and Cord Organizer for Home Office Standing Desk
  • 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
  • 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
  • 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
  • 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
  • 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
define('FS_METHOD', 'ftpsockets');
define('FTP_HOST', 'ftp.example.com');
define('FTP_USER', 'your_ftp_username');
define('FTP_PASS', 'your_ftp_password');

This method uses PHP’s sockets class. It still depends on network reachability, a valid account, and permission to write the destination. It is not a fix for wrong ownership or an account jailed in the wrong directory.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Step 6: Correct paths on non-standard or symlinked installations

Most sites need only FTP_HOST, FTP_USER, and FTP_PASS. Symlinked, relocated, or unusually structured installations may also need path constants:

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
define('FTP_BASE', '/full/path/to/wordpress/');
define('FTP_CONTENT_DIR', '/full/path/to/wordpress/wp-content/');
define('FTP_PLUGIN_DIR', '/full/path/to/wordpress/wp-content/plugins/');

FTP_BASE represents the WordPress root, normally the value of ABSPATH. The content and plugin constants identify their respective directories. Define the base first and add the more specific paths only when the host’s layout requires them. A trailing slash, chroot prefix, or symlink target that differs between the shell and the FTP service can make an apparently valid path fail.

To diagnose a path problem, use the FTP client’s home directory as the starting point and locate the directory that contains wp-admin and wp-includes. The path WordPress needs may be relative to the FTP account’s jailed root rather than the server’s absolute filesystem path. Ask the host for the path as seen by the FTP service.

What each error usually indicates

Symptom Likely cause Next check
WordPress asks for FTP credentials immediately Direct filesystem access was rejected or not detected Test FS_METHOD direct, then verify PHP-user ownership and write access
Direct mode still cannot update Ownership, permissions, read-only storage, quota, or a security policy Have the host inspect the failing path and the PHP/web user
FTP client logs in but WordPress cannot update Wrong protocol, port, jailed path, or insufficient write rights Confirm the account can create and replace a test file in the WordPress root
Connection times out Firewall, passive-mode, DNS, or blocked outbound connection Verify the host, port, firewall rules, and whether outbound FTP is allowed
503 appears during an update Host-specific connection routing or resource limit Ask whether FTP_HOST must be localhost and check server logs
PHP reports a missing FTP or SSH2 extension The selected transport is unavailable to web PHP Enable the extension for the active PHP handler or choose a supported method
Only plugins or themes in a symlink fail WordPress is resolving a different path from the FTP service Set the appropriate base/content/plugin path after confirming the host’s layout

How to test safely after a change

  1. Log out and back in so WordPress starts a fresh filesystem request.
  2. Update one small plugin or theme that has a known available version.
  3. Watch for a successful download, unpack, copy, and activation result; a download alone does not prove that files were replaced.
  4. Check the site and the WordPress dashboard for PHP errors, maintenance mode, or a partially updated extension.
  5. Run a second update only after the first completes and the site remains healthy.

If an update stops halfway, restore the file backup or hosting snapshot before trying another transport. A failed update can leave a plugin directory incomplete even when the dashboard still loads.

Security and maintenance rules

  • Prefer direct mode only when the web user’s ownership and access are correctly configured; the official documentation warns that direct access can carry security risk on poorly configured hosts.
  • Use encrypted transport when the host supports it. Remember that FTPS and SFTP are different protocols.
  • Store FTP passwords and private keys in wp-config.php only when necessary, and restrict access to that file.
  • Do not commit configuration files containing credentials to a public or shared repository.
  • Remove temporary FS_METHOD, credential, and key constants when the host’s normal configuration works again.
  • Never use a blanket world-writable setting as a troubleshooting shortcut.
  • After changing a password, key, PHP version, or hosting account, retest the update path because extensions and filesystem users can change with the service.

When to contact hosting support

Contact the host when you cannot identify the PHP/web user, cannot change ownership, do not know the FTP service’s jailed path, or receive timeouts and 503 responses. Include the exact WordPress action, timestamp, selected method, host and port (without the password), and the complete error text. Ask support to verify:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
  • the PHP handler and its loaded FTP or SSH2 extensions;
  • ownership and write access for the WordPress root and wp-content;
  • disk and inode quotas;
  • firewall and outbound FTP/SSH rules;
  • the correct FTP root, passive-mode requirements, and whether localhost is required;
  • server logs for denied writes, security-module blocks, or failed authentication.

Provide no private key or password unless the host has a secure credential-sharing process. A support technician can usually confirm the filesystem user and path without receiving either.

Remove the workaround when the root cause is fixed

Once direct access works reliably, delete the temporary FTP credentials and the explicit FS_METHOD line unless your host specifically requires that method. If a transport remains necessary, document why, keep the smallest set of constants, and review them after PHP or hosting changes. The durable fix is a consistent relationship between the PHP process, file ownership, filesystem permissions, and the path WordPress is updating—not merely a prompt that accepts a password.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.