WordPress asks for FTP credentials: restore the correct access method

Identify why this form appears now

You start an update or installation and WordPress displays “Connection Information” with an FTP hostname, username and password. This request concerns access to hosting files. It does not mean your WordPress administrator account has become invalid. The goal is to restore the intended method for modifying these files, then complete the authorized operation.

On a site that previously wrote directly, look for the recent change: migration, restoration, deployment, PHP modification or addition of a configuration constant. On a new installation, this request may reflect the provider’s normal chosen setup. Its presence alone proves neither an intrusion nor a particular permission that should be applied.

This guide concerns self-hosted WordPress. In multisite, installations and updates are prepared at network level with the corresponding permissions. For managed hosting that requires its own deployment tool, follow that policy. Do not try to make code writable from WordPress if that restriction is part of the intended setup.

On WordPress.com, any SFTP access is provided by the platform according to the plan; it is not an FTP account to invent for this window. If the window appears on your managed site, send support a screenshot without secrets and the action that triggered it. The ownership corrections and cPanel routes below concern a self-hosted environment whose files you actually administer.

Distinguish the WordPress account, file access and database

The WordPress administrator account opens the dashboard. FTP, FTPS or SFTP access concerns files on a server and comes from the provider or hosting administrator. The MySQL or MariaDB user serves the database. These three functions differ even when one person manages the site.

Do not therefore enter your WordPress password or database secret into the FTP form as an experiment. First find the authorized file account details and protocol. The file server address may differ from the public domain. An account restricted to one folder must cover the location required by the operation without granting access to other server customers.

If you have no file or panel access, native diagnostics remain possible, but an ownership correction requires the technical administrator. Send them the exact operation and recent change. They do not need a password in a ticket to begin investigating.

Prepare a limited intervention and its rollback

Before changing configuration or permissions, preserve initial values and a private copy of wp-config.php. This file contains secrets: keep the copy outside any directory served on the web. For an actual update, also prepare a restorable backup of files and database with a known date and scope.

The first route looks for a transport choice forced in error; it applies after a documented configuration addition. The second examines the path and its permissions, then corrects an item confirmed to be in the wrong state. An observation in Site Health helps you choose; it does not authorize changes to the whole installation.

Test on a copy when possible, with its own files and database and with outgoing messages and external operations disabled. A second domain pointing to the same files is not such a copy. Prepare an appropriate window for the live site and check that another tool is not already updating the same files. Reverting a configuration line is simple; undoing an update that transformed data requires coordinated restoration.

Read what WordPress can write in Site Health

Open Tools, Site Health, then the Info tab. The Filesystem Permissions section indicates whether WordPress considers several directories writable: the main directory, content, plugins, themes or media, depending on the installation. Available labels and sections vary with the version and components.

A directory reported as writable does not establish that every file within it can be replaced. A particular plugin directory may have a different owner or permissions. Conversely, deliberately unwritable code may reflect a deployment policy. Relate this observation to the specific action rather than trying to make every indicator favorable.

1. Expand Filesystem Permissions and record only lines relevant to the blocked operation.
2. Also note the PHP version and useful paths shown in the information without publishing the full technical export.
3. Compare with the directory named by the failure message, if there is one. Keep the two findings separate.
4. After a correction, return to this screen and compare. This read-only check involves no change to undo.

Understand transport selection before forcing it

WordPress has several transports for reading and modifying files. The direct method uses PHP; others use FTP or SSH2 according to available capabilities. To automatically select direct access, WordPress may create a temporary test file and compare its owner with that of its own files. The directory tested depends on the operation’s context.

Being able to upload a file through the hosting file manager does not prove PHP acts with the same identity. Similarly, an SSH account that can write to the directory does not prove the web process can. This difference explains why a hosting or PHP execution-mode change can make the form appear.

An FS_METHOD definition in wp-config.php or a software filter may impose another method. This also explains why changing permissions does not always remove the prompt. Before any correction, have forced transport, ownership differences and actual write denial distinguished. Diagnosis does not mean trying every method in turn until the form is hidden.

Approach 1: remove an FTP override added by mistake

This is a specific case: an FS_METHOD definition was recently added, its author confirms it is unnecessary and the environment is supposed to select its method automatically. Private configuration access is required through SFTP or an authorized manager. If the host requires this transport, do not remove its setting.

The example shows how to comment out a fictional old line forcing ftpext. Do not add this comment alongside a definition that remains active: modify the identified line itself. If a variable or another file supplies the value, have its source corrected. Do not replace the entire file with this snippet.

1. Copy wp-config.php to private storage and search the entire file for FS_METHOD.
2. Comment out only the confirmed erroneous addition, as in the example, then save without changing other settings.
3. Return to the intended operation after preparing its backup. WordPress should be able to make its selection again; direct access is not guaranteed.
4. If the problem persists or the setting was necessary, restore the original line. A PHP error requires immediately restoring the private copy.

// define( 'FS_METHOD', 'ftpext' );

Avoid confusing direct access with permission repair

Adding FS_METHOD with the value direct forces the PHP transport but creates no additional system permissions. The form may disappear while file replacement fails later. Its disappearance does not prove ownership is correct or isolation between sites is preserved.

A direct setting may be legitimate in a specifically prepared environment. It requires the administrator to have checked PHP identity, necessary permissions and isolation policy. In that case, apply their precise configuration with a backup and rollback. This guide does not offer that line as a universal remedy for every FTP prompt.

If you already added it for this incident and the error moved to an unwritable directory, record the new message. Return to the original configuration if the change was unjustified, then examine that directory. Do not increase permissions to make a forced transport work when its suitability has never been established.

Approach 2: find the path and item actually being denied

This approach fits situations where the intended method is known but writing fails at a specific location. Access to the correct hosting subscription’s panel or files is required. Find the root corresponding to the domain, then the path of the relevant installation; public_html is not necessarily the directory for every site.

The message may name wp-content/upgrade, a plugin directory or a destination file. Core and plugin updates do not require exactly the same access. Record the named item and parent directory where a file must be created. A neighboring copy with the same name must not receive the correction.

Also check whether the path is a symbolic link or belongs to an automated deployment. A manual correction may be undone at the next deployment or target a different location than expected. If ownership is wrong after restoration, have the provider correct it. Your file manager may not support that operation even if it displays a Permissions button.

Correct a confirmed permission in cPanel

This route concerns one item with a value already confirmed as appropriate for your hosting. Directory mode 755 or file mode 644 is common but not a universal solution. Directory and file requirements differ; no test justifies 777 or recursively applying changes to all sites.

In cPanel, open Files, then File Manager. The administrator must distinguish permission from ownership before this correction. If your account cannot modify the item, do not broaden an unrelated parent’s permissions to bypass the denial.

1. Open the confirmed path and select exactly the affected file or directory.
2. Click Permissions and record its current value with the path.
3. Enter only the confirmed value, verify the selected item and confirm with Change Permissions.
4. Retry one intended operation and observe its result. The expected result is authorized writing in this area, not simply disappearance of the form.
5. If the correction was unjustified or ineffective according to the diagnosis, restore the initial value; do not progressively increase the numbers.

Read Linux ownership without changing files

This variant is for someone with authorized SSH access. The following command displays information for the three specified paths; it changes neither permissions nor ownership. Replace /CHEMIN/CONFIRME/wordpress with the actual absolute root. Adapt the last path to the affected directory; if it is absent, record that instead of hiding it through improvised creation.

The -d option displays directories themselves, and -n displays numeric owner and group IDs. Also record the item’s type and permissions. A symbolic link requires identifying its actual target before any correction. Missing information or a read denial is a result to report.

Compare these IDs with the expected account for the hosting environment. With PHP-FPM, the administrator finds process identity in the site’s pool configuration; it is not necessarily your SSH session account. Do not conclude that everything should belong to www-data, apache or your personal user. Correct ownership depends on isolation and deployment arrangements.

ls -ldn '/CHEMIN/CONFIRME/wordpress' '/CHEMIN/CONFIRME/wordpress/wp-content' '/CHEMIN/CONFIRME/wordpress/wp-content/upgrade'

Distinguish incorrect ownership, quota and deliberately protected code

If restored files belong to another account, send their path and recorded IDs. The provider must compare them with site policy and correct the affected scope. A global chown or chmod command across the whole subscription may affect private archives, other sites and files with intentional protections.

Writing may also fail because capacity is exhausted. In cPanel, open Files, Disk Usage and inspect account indicators. A disk quota exceeded message points to the quota; file-count limits may also exist depending on the provider. Changing ownership does not free space. A backup created in an already full account may itself fail: verify its result, not just its launch.

Finally, a managed deployment may reserve code replacement for its own tool. In that case, have the prepared version applied through that process with checks and a rollback option. Keeping code unwritable from PHP is not automatically a failure. Avoid manual changes that would be overwritten at the next deployment.

If hosting genuinely requires a file transport

Some environments are designed to use a separate transport. Before entering credentials, have the provider confirm the expected form, server, port, restricted account and authorized protocol. FTP, FTPS and SFTP are not interchangeable. HTTPS in your administration area protects the browser-to-site connection; by itself it does not describe the connection between PHP and the file server.

The native form may offer FTP, FTPS (SSL) or SSH2 according to available PHP extensions. The FTPS label does not guarantee certificate verification: the PHP transport used by WordPress relies on ftp_ssl_connect, whose documentation states this limitation. Have this route validated in your context, or use the secure transfer process specified by the host. Do not switch to unencrypted FTP to make a connection error disappear.

In an expressly validated process, enter the supplied host, possibly followed by :port in the Hostname field according to the instructions received, the file username and its secret, then the matching type. Do not use the SQL password. Native processing avoids saving the password in the connection option; this does not guarantee the behavior of a form replaced by a plugin. Do not permanently add FTP secrets to wp-config.php to avoid reentering them.

Retry one update and check the result

After the correction, return to the originally intended operation. For a plugin, use its row under Installed Plugins; for core, open Dashboard, then Updates. Verify the component and target version before confirming. Keep the screen open until the result and record the time of this new attempt.

If the credentials prompt disappears but a download from WordPress.org fails, the incident has moved to a different stage: examine the outbound connection. If the archive is invalid, examine the package. If a specific directory remains denied, access scope is not yet corrected. These results call for different actions, not another automatic FS_METHOD addition.

Then check the installed version and a representative component function. Inspect the public site and administration area. On a copy, use test data without real effects. On the live site, prepare sensitive tests with its administrator. A successful FTP connection does not prove an update finished, and a completed update does not prove all site functions remain intact.

Close the intervention with a precise rollback record

Keep the corrected path, previous value, new value and check result. A permission change can be undone by restoring the recorded value. A configuration line can be restored from its private copy. For an ownership correction performed by the provider, request the initial account, expected account and scope actually changed.

Do not confuse these rollbacks with undoing an update. If the component has already changed its database or settings, restoring only its old files may leave an inconsistent state. Preserve new data and have the prepared restoration plan applied before overwriting the live site with a backup.

No new plugin is needed for this process. A plugin hiding the form cannot give PHP missing system permissions or correct server-imposed ownership. To obtain targeted assistance, provide the domain, time, action, exact message, paths and recent changes. Keep credentials, keys and configuration copies in private storage.

Read only the forced transport with WP-CLI

If WP-CLI is already available in a trusted environment, the maintainer can look for the FS_METHOD definition without displaying configuration secrets. Confirm the installation path before reading:

This command targets one constant and runs before WordPress loads. Do not omit its name to display the entire configuration: the diagnosis does not need SQL passwords or security keys. If it returns ftpext, ssh2 or direct, compare that value with the hosting provider’s documented method before changing anything.

If the constant is not found, this proves neither that direct access is used nor that the directory is writable. Another file, managed configuration or WordPress filter may be involved; ask the maintainer to trace that source. Reading configuration does not execute the selection mechanism’s write test and does not validate an update.

Without a terminal, a targeted search in a private copy of wp-config.php provides the same initial clue. No additional plugin is necessary. The expected result is an identified definition or documented absence; this read-only check changes nothing and requires no rollback.

wp --path='/chemin/wordpress' config get FS_METHOD --type=constant