WordPress asks for FTP credentials when the PHP process cannot safely write to, replace, or create files in your installation. The durable fix is to align the ownership and permissions of the WordPress directories—especially wp-content/plugins—with the account that runs PHP, or to use the hosting account’s SFTP/FTP method when that is the intended security model. Do not solve the prompt with 777 permissions or by forcing direct filesystem access.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
Ownership is host-dependent. The correct owner might be a web-server account such as www-data, another PHP service user, or your hosting account. Identify the actual execution account and document root before changing anything.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
WordPress Multisite Administration | $34.38 | Buy on Amazon |
| 2 |
|
Mon Site WordPress – Volume 2 – Administration & Utilisation (French Edition) | $9.90 | Buy on Amazon |
| 3 |
|
WordPress 24-Hour Trainer | $3.95 | Buy on Amazon |
| 4 |
|
Teacher Record Book | $4.89 | Buy on Amazon |
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Why WordPress requests FTP credentials
When you click Update on a plugin, WordPress first decides how it can reach the server filesystem. Its Filesystem API examines file ownership and write access. If the running PHP process can create and replace files and the resulting files will have suitable ownership, WordPress can use direct filesystem I/O. The update then runs from the dashboard without another login.
If PHP cannot write safely, WordPress can fall back to a transport that authenticates separately: FTP, encrypted FTPS, SFTP, or an SSH-based method. The credential form is therefore usually a symptom of a filesystem mismatch, not a plugin defect. A plugin can be perfectly healthy while its parent directory is owned by an account that PHP is not allowed to use.
#1 Best Overall
WordPress documentation describes the rule this way: it determines the filesystem method from the ownership of the WordPress files. When the files belong to the process owner and new files created by WordPress will also belong to that user, WordPress can modify them directly without asking for credentials.
Understand the two accounts that matter
The PHP or web-server execution account
Your site code runs under an operating-system user. Depending on the stack, that may be www-data, apache, httpd, nobody, a PHP-FPM pool user, or a hosting account created specifically for your site. The name is not universal; never change ownership to www-data just because it is common on one Linux distribution.
The file owner and group
Every file and directory has an owner and a group, plus permission bits that control reading, writing, and entering directories. WordPress needs write access to the relevant directory and to files it must replace. A directory can appear writable while an individual plugin file, parent directory, or mount restriction still blocks the update.
Why newly created files matter
An update extracts a package into temporary locations, removes or replaces old files, and creates new files. It is not enough for PHP to edit one existing file. The account and group setup must also give newly created files an ownership pattern that permits subsequent updates and does not expose the site to unrelated users.
Choose an ownership model before changing anything
There is no single owner that is correct for every WordPress installation. Use the model that matches how your host isolates sites and how you administer files.
| Situation | Who normally owns the files | How updates work | Main trade-off |
|---|---|---|---|
| Single-user server or dedicated virtual machine | The site account, the PHP user, or a carefully configured owner/group combination | Direct dashboard updates when PHP can write and new files retain suitable ownership | Convenient, but a web process with broad write access increases the impact of a compromised site |
| Shared hosting with a control panel | Usually the hosting or FTP account, according to the provider’s isolation scheme | Use the provider’s SFTP, FTPS, or FTP credentials when direct writes are not part of the design | Preserves the host’s isolation model, but dashboard updates may prompt for credentials |
| Separate PHP-FPM pool user | A group or owner arrangement explicitly configured for that pool | Direct writes only to the directories intentionally delegated to the pool | Requires precise group and permission management |
| Plain FTP administration | Not established by the available documentation | Credentials are supplied through WordPress’s Filesystem API | FTP is not encrypted; prefer SFTP or FTPS when the host offers it |
On shared hosting, changing everything to the web-server account can break the provider’s isolation or prevent you from managing files later. Keeping ownership with the hosting account and entering SFTP or FTPS credentials can be the safer, supported choice.
Safe diagnosis before touching ownership
- Back up the site. Create a current copy of the database and all site files. Confirm that the backup can be restored, not merely that a file archive was created.
- Confirm the document root. From the hosting panel, SFTP, SSH, or file manager, identify the directory that contains
wp-admin,wp-includes, andwp-content. Do not run a recursive ownership command from a parent directory that contains other sites. - Record the current state. Inspect the owner, group, and permissions of the root,
wp-content, andwp-content/plugins. On a Unix-like host, a read-only check such asls -ld /var/www/example /var/www/example/wp-content /var/www/example/wp-content/pluginsshows the first ownership clues. Replace that example path with the verified document root. - Inspect representative plugin paths. Check one plugin directory and a file inside it. A parent owned by one account and plugin files owned by another can explain why only some updates fail.
- Identify the execution account. Use your host’s PHP-FPM, Apache, or control-panel documentation. On a server you administer, process listings and the PHP-FPM pool configuration reveal the worker user; on managed hosting, support or the panel may be the only authoritative source. Do not infer the account from the operating system alone.
- Check whether the filesystem is special. Read-only mounts, container volumes, ACLs, security modules, and disk quota limits can produce the same symptom even when the basic owner looks correct.
For a GNU/Linux system where it is available, stat -c '%U %G %A %n' /var/www/example/wp-content/plugins gives a compact owner, group, mode, and path report. Treat these commands as inspection only; permission syntax and available tools differ between hosts.
Repair a single-user or self-managed server
Use this path only when you control the server and understand its PHP execution model. The objective is narrow: grant the PHP account the access needed for WordPress updates without changing unrelated sites or system directories.
Rank #3
- Set shell variables to the verified values. In an SSH session, you can keep the path and account visible while working:
export WP_ROOT=/var/www/exampleandexport PHP_USER=sitephp. Use the actual document root and execution account you confirmed; these names are examples, not universal defaults. - Review before applying. Run
ls -ld "$WP_ROOT" "$WP_ROOT/wp-content" "$WP_ROOT/wp-content/plugins"and inspect several plugin entries. Save the output so you can reverse an accidental change. - Apply the smallest documented change. Follow your distribution, control panel, or hosting provider’s documented
chown,chgrp, andchmodprocedure. A command such aschown -R "$PHP_USER":GROUP "$WP_ROOT/wp-content/plugins"is appropriate only if your host explicitly uses that owner/group model and you have verified the group name. Do not copy it blindly, and do not include a parent directory containing other sites. - Preserve least privilege. If the host uses a shared group, grant group write access only where WordPress needs it and keep unrelated files outside that group. Avoid changing the entire operating-system tree or every file under a virtual-host parent.
- Verify the result. Re-run the ownership inspection, then test whether the PHP account can create and remove a harmless temporary file in the intended directory using the host-approved method. Remove the test file immediately. If policy forbids such a test, ask the administrator to perform it.
- Retry one plugin update. Use a small, non-critical plugin first. A successful update without a credential prompt indicates that direct filesystem access is now available for that path; it does not prove that every directory on the site has the same configuration.
There is no safe universal numeric mode for every host. Existing ACLs, PHP-FPM pools, deployment tools, and security policies can make a seemingly reasonable recursive command incorrect. Use the host’s documented values rather than a copied “magic” command.
Repair the workflow on shared hosting
Shared hosts often deliberately keep files owned by your hosting or FTP account while the web server runs under a different, restricted identity. That arrangement can be safer than handing the web process ownership of the entire installation.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Open the hosting panel’s file, FTP, or SSH documentation and identify the supported transport. Prefer SFTP or FTPS because they encrypt credentials and file contents in transit; plain FTP does not.
- Confirm the account’s home directory and the WordPress document root. A common failure is entering credentials for the account but pointing WordPress at a directory from a different site or subscription.
- In WordPress, enter the supplied connection type, hostname, port, username, and password when the update screen prompts you. Use the exact values from the host; do not guess a port or substitute a panel login if the provider issued a separate transfer account.
- Run the update and verify that the plugin version changed and that the site remains functional. If the host offers a one-click WordPress updater, that tool may already know the correct account and should be preferred over manual ownership changes.
If a provider’s supported model requires credentials, repeated prompts are not evidence that ownership is broken. Ask support whether direct PHP writes are permitted before changing anything; a forced ownership change can violate the service’s isolation rules.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Retrying an update and removing a stale failure notice
After correcting ownership or entering valid transfer credentials, retry the update from Dashboard → Updates or the plugin screen. Watch for the complete result, including extraction, activation, and any database migration message. A successful download alone does not prove that the replacement completed.
Rank #4
- Keep track of everything from attendance to test scores
- Spiral bound
- Measures 8-1/2" x 11"
WordPress can leave a maintenance marker after an interrupted update. If the dashboard still reports a failed update after the filesystem problem is fixed, connect with SFTP, FTP, or the host file manager, open the WordPress root, and remove the file named .maintenance. WordPress documents this as the recovery step for a stale maintenance notice. Do not delete similarly named files elsewhere, and do not remove the marker while another update is actively running.
Security boundaries you should not cross
Never use 777 as a blanket fix
Mode 777 lets the owner, group, and every other local user write and execute. WordPress warns that world-writable files allow other server processes or users to modify the installation, creating a security exposure. It may suppress the prompt while making a compromise easier and making forensic ownership unclear.
Do not force FS_METHOD=direct just to hide the prompt
The FS_METHOD setting can select direct filesystem access, but WordPress documents that direct I/O is unsafe on poorly configured hosts. Forcing it does not grant legitimate permissions; it can turn a visible warning into failed updates or an unnecessarily writable installation. Fix the account model or use the supported encrypted transfer method instead.
Avoid unverified recursive changes
A recursive chown or chmod can alter backups, deployment files, sockets, neighboring sites, or system directories if the starting path is wrong. Keep a backup, verify the path, limit the command to the required WordPress subtree, and record the original state.
Quick Recap
Troubleshooting by symptom
| Symptom | Likely explanation | Next check |
|---|---|---|
| The prompt appears for every plugin | PHP cannot write to the WordPress content tree, or the host intentionally requires transfer credentials | Confirm the execution account, document root, and provider-supported update method |
| Only one plugin fails | That plugin directory or a file inside it has different ownership, permissions, or an immutable/ACL rule | Inspect the specific directory and its parent; compare with a plugin that updates successfully |
| Credentials are rejected | Wrong protocol, host, port, account, or directory; the provider may require SFTP or FTPS instead of FTP | Copy connection details from the host and test the same account in an SFTP client |
| Update downloads but cannot unpack or replace files | Temporary-directory, quota, disk-space, archive-extraction, or write permission problem | Check available space, PHP temporary paths, and write access to both the temporary and destination directories |
| Update succeeds but the warning remains | A stale .maintenance marker remains in the WordPress root |
Remove that marker through SFTP, FTP, or the file manager after confirming no update is running |
| Ownership keeps reverting | A deployment job, host repair tool, container volume, or security policy reapplies its own owner/group | Find the process that changes ownership and use its supported configuration rather than fighting it manually |
Prevent the next ownership failure
- Document the verified WordPress root, PHP execution account, owner, group, and supported transfer protocol for each site.
- Keep file and database backups current before core, theme, or plugin updates.
- Use SFTP or FTPS instead of plain FTP when the host supports encrypted transfer.
- Review new server migrations, PHP-FPM pool changes, container rebuilds, and deployment jobs for ownership changes.
- Grant write access only to the directories that need dashboard updates; do not make the whole server writable by the web process.
- After a repair, test one plugin update and record the result before changing additional permissions.
- If you cannot identify the execution account or the host’s isolation model, ask the host or a server administrator for permissions help rather than guessing.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
