Halloween DealsAmazon USHalloween week deals: useful picks before month-endAmazon US: current deals, useful picks and tech finds.Check DealsClean PCRecommendedOne scan can reveal what keeps slowing WindowsLook for cleanup and repair opportunities.Run ScanHalloween DealsAmazon USOctober picks are moving - compare before checkoutAmazon US: current deals, useful picks and tech finds.See Picks×
VGSOURCES
Get listed

file permissionsPATCH 2026.10.15

Fix WordPress FTP Credentials Not Working on One Site

By VGSources Team 11 min read

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

If WordPress asks for FTP credentials on only one site, the password is usually not the problem. The affected site is using a different filesystem context: a different host, port, protocol, document root, directory jail, file owner, group, PHP user, or filesystem method. Verify those details in that order, then correct ownership or least-privilege permissions with the host. WordPress requests filesystem credentials when it cannot write directly through the PHP process; a working FTP login alone does not prove that WordPress can update files. See the WordPress file-permission guidance and the Filesystem API documentation for the underlying rules.

Why WordPress asks for FTP on only one site

WordPress does not decide whether to show the credential form by testing your password first. Its Filesystem API determines which transport can create or modify files for the current site. When the PHP or web-server process cannot write directly, WordPress falls back to a remote filesystem method and asks for credentials.

As an Amazon Associate I earn from qualifying purchases.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

That decision is local to each installation. Two sites on the same hosting account can have different document roots, owners, groups, PHP handlers, chroot or jailed paths, enabled PHP extensions, or wp-config.php settings. Consequently, an FTP account can work perfectly on one site while the other site still prompts.

  • Direct write failure: the PHP process does not own the files and has no permitted group write access.
  • Endpoint mismatch: the failing site uses a different hostname, port, username, protocol, or TLS/SSH setting.
  • Path mismatch: the account logs in successfully but starts outside the failing site’s document root, so WordPress cannot find wp-content.
  • Transport mismatch: the server expects SFTP over SSH while WordPress is configured for FTP, or the required PHP extension or socket connection is unavailable.

Use the working site as a control. Compare its endpoint, root path, ownership, PHP user, and filesystem method with the failing installation instead of changing a global password or making every file writable.

#1 Best Overall
Sale
Gaoye Blue Light Blocking Glasses | Anti UV Ray, For Computers & Gaming, Square Frame, Eyewear for Men and Women
  • BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
  • EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
  • COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
  • LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
  • WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.

Follow this diagnostic order

  1. Record the exact host, port, username, protocol, and remote path supplied for the affected site.
  2. Log in with an independent FTP or SFTP client and confirm that the session reaches the directory containing wp-content.
  3. Compare the affected site’s file owner, group, directory modes, and PHP/web-server user with a site that updates normally.
  4. Inspect FS_METHOD and the transport WordPress is actually allowed to use.
  5. Apply the smallest host-side correction, test a harmless update, and remove any temporary override that is no longer needed.

Changing FS_METHOD before checking the path and ownership can hide the symptom without fixing the write failure.

1. Verify the endpoint and protocol

Use the host’s exact connection details

Start with the hosting control panel or support documentation for this specific site. Confirm the hostname, port, username, and protocol character for character. A shared account may expose separate FTP accounts, server names, or ports for different subscriptions. Do not assume that the credentials used on a working site belong to the failing site’s service.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

WordPress can receive connection details through constants such as FTP_HOST, FTP_PASS, and FTP_SSL in wp-config.php. The official wp-config.php reference explains these settings. Check for a site-specific value that overrides what you enter in the prompt, and verify that a password has not been copied with an extra space or outdated special character.

Distinguish FTP, FTPS, and SFTP

Transport What it means What to verify
FTP Traditional file transfer; credentials and data are not protected in transit unless another security layer is added. Provider’s FTP hostname, port, account, and whether plain FTP is enabled.
FTPS FTP protected with TLS. That the server expects TLS, the correct port, and the certificate or encryption mode accepted by the host.
SFTP File transfer over SSH; it is a separate protocol, not FTP with a different password. SSH hostname, SSH port, account, authentication method, and the server’s SFTP starting directory.

WordPress’s security guidance describes SFTP as FTP-like file transfer with the password and other data encrypted during transmission; read the Hardening WordPress guidance. Selecting an SFTP client while entering an FTP endpoint, or selecting FTP in WordPress while the host only permits SFTP, produces a failure that looks like a bad password.

2. Confirm the remote document root

A successful login can still open the wrong directory

Many hosting environments place each site in a separate directory, while an FTP account may be jailed to a parent directory or assigned to a different root. The client can report “connected” even though the session does not contain the failing installation. WordPress then cannot find or modify wp-content, themes, plugins, or its update temporary files.

Rank #2
Windex Gaming Cleaning Wipes, Pre-Moistened Wipes to Instantly Clean all Gaming Gear and Electronics, Resealable Packaging for a Freshness Lock, 25 count (Pack of 1)
  • WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
  • AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
  • PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
  • ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
  • COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
  1. Connect with the exact account used for the affected site.
  2. Locate the directory that contains wp-admin, wp-includes, and wp-content. That is the WordPress document root for this installation.
  3. Compare the starting directory and full path with the site that works.
  4. If the account opens one level too high, one level too low, or in a sibling site’s directory, ask the host to correct the account’s home or jail rather than moving WordPress files blindly.

Also inspect WordPress’s own URL and path assumptions when the installation was migrated. A domain can point to one directory while the FTP account is assigned to another. The decisive test is whether the authenticated session can reach the real wp-content directory for the failing site and has permission to create a test file there.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

3. Compare ownership and the PHP user

FTP identity and web-process identity are different

An FTP account authenticates your file-transfer session. WordPress normally writes through PHP, which runs as a web-server or PHP-FPM user. Those identities may be different. A valid FTP password therefore does not establish that the PHP process can update the installation.

WordPress’s file-permission documentation says files that need to be writable should be owned, or group-owned, by the account WordPress runs as. Ask the host to identify all three identities:

  • the owner and group recorded on the affected site’s files;
  • the user and group used by its PHP-FPM pool or web server;
  • the owner and group assigned to the FTP or SFTP account.

Compare those values with a working site on the same server. If the working site has the PHP user as owner but the failing site is owned by a different system account, a deployment, restore, migration, or manual upload may have changed ownership. If the PHP user is only in the file’s group, that group must also have the required write bit. Ownership is a host-level correction on many managed platforms; do not run a recursive ownership command unless the provider gives you the exact account and path.

Why this produces a credential prompt

When direct writes are unavailable, WordPress asks for a transport that can write as another account. Supplying the same FTP password repeatedly cannot grant the PHP process new operating-system permissions. Fix the owner, group, or account mapping first when the independent client can already write to the correct path.

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Rank #3
Sale
LISEN Cell Phone Stand Phone Holder for Desk, Office Decor Gadgets for Men | Office Gifts for Women, iPhone Stand, Gadgets for Men, Office Decor, Gaming Desk Accessories for Samsung Fold 8, Switch, iPad
  • Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
  • Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
  • Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
  • ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
  • Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)

4. Check permissions without creating a security hole

Use least privilege

The WordPress handbook gives general examples of directories at 755 or 750 and files at 644 or 640, with stricter treatment for wp-config.php. These are starting points, not a universal command for every host. The required mode depends on the owner/group arrangement and whether the server uses a suexec-style setup.

Object General WordPress guidance Important qualification
Directories 755 or 750 The PHP user still needs the relevant ownership or group access.
Regular files 644 or 640 Files that WordPress must update need write access for the effective owner or group.
wp-config.php Stricter than ordinary files Use the host’s documented secure mode while retaining the access WordPress needs.

Do not set every directory to 777 as a blanket fix. The guidance specifically says that, in the described suexec-style setup, directories should not be set to 777. World-writable paths increase the impact of a compromised process and can still fail if ownership, ACLs, or the PHP handler are wrong. Have the host repair only the affected site’s owner/group and the minimum modes needed for updates.

5. Understand and use FS_METHOD carefully

Documented values and automatic order

WordPress recognizes four filesystem methods: direct, ssh2, ftpext, and ftpsockets. The get_filesystem_method() reference documents the automatic priority as Direct, SSH2, FTP PHP Extension, then FTP Sockets.

  • direct asks PHP to write through the local filesystem.
  • ssh2 uses the SSH2 transport and requires the server-side support and valid SSH details.
  • ftpext uses PHP’s FTP extension.
  • ftpsockets uses FTP sockets when the extension path is unavailable.

The valid value is a method name, not a protocol nickname. For example, setting FS_METHOD to sftp is not one of the documented values.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

When a temporary override is reasonable

WordPress advises changing FS_METHOD only to address a diagnosed update problem and reverting the change if it does not help. If a host confirms that the PHP process owns the files but automatic detection is choosing the wrong method, a targeted setting in wp-config.php can test the diagnosis:

Rank #4
Ledagic IC+RGBW USB Powered Led Light Bar with App & Remote Control, 2 Pack
  • Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
  • Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
  • 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
  • Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
  • USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
define('FS_METHOD', 'direct');

Place the definition before the line that says WordPress should stop editing the configuration file, and preserve a backup of wp-config.php before editing it. Use only one definition. If the host instead provides a supported SSH or FTP transport, the corresponding documented method may be appropriate, but it still needs the correct extension, port, encryption mode, account, and path.

Why forcing direct is not a universal fix

Forcing direct can remove the prompt while leaving the underlying ownership failure. Updates may then fail with a less obvious write error, or a plugin may create files owned by an unexpected account. Conversely, forcing an FTP method fails when PHP lacks the required extension, sockets are blocked, TLS settings do not match, or the account starts in the wrong directory. Treat the setting as a diagnostic or narrowly justified configuration change, not a substitute for correct server permissions.

6. Test independently of WordPress

What an external client can prove

Use a neutral FTP or SFTP client to test the same host, port, protocol, username, and path. A successful session should let you browse to the failing site’s document root and, with the host’s permission, create and remove a harmless test file in the directory that needs updating.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
External test result Most likely focus
Cannot connect or authenticate Provider credentials, endpoint, protocol, port, account status, or service availability.
Connects but cannot reach wp-content Document root, account home, chroot/jail, or site mapping.
Reaches the root but cannot create a permitted test file FTP account permissions, owner/group, directory mode, quota, or host policy.
Can write successfully, but WordPress still prompts PHP ownership context, FS_METHOD, PHP extensions, or WordPress path detection.

This test separates a service problem from a WordPress filesystem-method problem. Do not upload a plugin or overwrite core files merely to test access; a small, removable file in the correct directory is enough, and some hosts prohibit even that test outside their control panel.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

7. Compare the failing and working sites systematically

Write the values side by side rather than relying on memory. The following matrix covers the differences that explain a one-site prompt.

Best Value
Sale
HUANUO FlowLift™ Dual Monitor Stand, Fully Adjustable Gaming Monitor Desk Mount for 13–32″ Computer Screens, Full Motion VESA 75x75/100x100 with C-Clamp & Grommet Base, Each Arm Holds 4.4 to 19.8 lbs
  • Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
  • Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
  • Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
  • Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
  • Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Comparison Working site Failing site What a difference means
FTP/SFTP hostname and port Record the provider’s value Record the provider’s value A separate service endpoint or blocked port can reject otherwise valid credentials.
Protocol and encryption FTP, FTPS, or SFTP FTP, FTPS, or SFTP The client and WordPress must use the service the host actually exposes.
Remote starting path Path containing that site’s wp-content Path containing that site’s wp-content A wrong jail or home directory leaves WordPress looking in the wrong tree.
File owner and group Owner/group reported by the host Owner/group reported by the host A changed owner or group can prevent direct PHP writes.
PHP/web-server user Effective process account Effective process account Different handlers or pools can have different access.
Directory and file modes Host-approved least-privilege modes Host-approved least-privilege modes Overly restrictive modes block writes; 777 is not an appropriate blanket answer.
FS_METHOD Unset or documented method Unset or documented method A site-specific override can force an unavailable transport.

8. Recovery paths for common findings

The independent login fails

Stop editing WordPress. Ask the host to confirm that the account is active, the password has not expired, the service accepts the selected protocol, and the supplied hostname and port belong to this site. Reset the account through the provider rather than copying credentials from another site.

The login works, but the root is wrong

Have the host assign the FTP/SFTP account to the directory containing the affected installation’s wp-content. Do not point the account at a parent directory containing several sites unless the provider explicitly supports that arrangement and you understand the security consequences.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

The login reaches the right root, but PHP cannot write

Request an ownership and group comparison with the working site. The host should identify the PHP-FPM or web-server user, repair the affected site’s owner/group mapping, and apply the least-privilege modes appropriate for its handler. Re-test a core, plugin, or theme update only after those values match the intended hosting model.

The host confirms ownership, but WordPress selects the wrong method

Review wp-config.php for an obsolete FS_METHOD or connection constants. Remove an unnecessary override, or test the host-recommended documented method temporarily. Restore automatic detection when the diagnosed problem is resolved.

An FTP client writes, but WordPress’s transport still fails

FTP-client success proves that account and path can work; it does not prove that PHP has the same network access or extensions. Ask whether the PHP environment includes the required FTP or SSH2 support, whether outbound connections are restricted, and whether the server’s TLS or SSH policy matches the method selected by WordPress.

9. Ask hosting support for the right checks

When you cannot inspect ownership, PHP pools, or jailed paths yourself, send support a precise comparison instead of only saying “FTP does not work.” Include the affected domain, the time of the failed update, the exact protocol and endpoint tested, and the fact that another site works.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
  • Compare the failing site’s document root with a working site’s document root.
  • Confirm that the FTP/SFTP account is jailed to the intended root and can see wp-content.
  • Report the file owner and group on the failing site’s WordPress files.
  • Identify the PHP-FPM or web-server user handling the failing domain.
  • Check whether that process user owns the files or has group write access where updates require it.
  • Confirm the available PHP FTP or SSH2 support and any outbound connection restrictions.
  • Review whether a site-specific FS_METHOD, FTP_HOST, FTP_PASS, or FTP_SSL value is overriding normal detection.

This information lets the provider correct the site without weakening every account on the server. If the host controls the filesystem, ownership, PHP handler, or jailed service, host-side remediation is safer than recursive permission changes from a shared shell account.

10. Security and maintenance precautions

  • Prefer SFTP or FTPS when the provider supports them; SFTP is distinct from FTP and encrypts credentials in transit.
  • Never publish or paste the FTP password into a support ticket, page, plugin setting, or version-control repository.
  • Back up wp-config.php before changing filesystem constants and remove temporary credentials or overrides after testing.
  • Do not use 777 recursively to silence the prompt.
  • Do not change ownership of unrelated sites in a shared account.
  • After a repair, test the actual operation that failed—such as installing a small update—then verify that newly created files have the expected owner and group.

The durable fix is a consistent mapping between the site, its document root, its PHP process, and the account used for approved file transfers. Credentials are only one part of that mapping.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

file permissionsFS_METHODFTPSFTPtroubleshootingWordPress

Leave a reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Recommended PC Tool
Recommended PC Tool
Outdated Drivers Are Slowing You DownFree scan - exact matches
PC Slower Than It Used to Be?Free scan - under a minute

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.