What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Create two separate, least-privilege accounts: an FTP/SFTP account that can reach only your WordPress files, and a database user attached only to the WordPress database. Use SFTP whenever your host offers it, then place the host’s exact database name, user, password and host value in wp-config.php. Correct ownership and write permissions determine whether WordPress updates files directly or asks for FTP credentials.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
This procedure applies to a self-hosted WordPress installation managed through a hosting panel such as cPanel or Plesk. Menu names vary by provider, but the account boundaries, database values and permission checks are the same.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Understand what you are creating
FTP/SFTP credentials and database credentials solve different problems. An FTP or SFTP account authenticates to the server’s filesystem, so it can upload, download, rename and delete files within the directory allowed by the account. A database user authenticates to MySQL or MariaDB, where WordPress stores posts, settings, users, comments and plugin data. Changing one password does not change the other.
WordPress’s own prerequisites assume that a self-hosted site has server login access through FTP or a shell and a supported MySQL or MariaDB database. You need access to the hosting control panel, the WordPress document root, and the database-management area before starting.
#1 Best Overall
- Your Personal Streaming Server - Build your own Netflix-style media library and stream 4K movies, shows and photos to any device without monthly fees
- Create Your Own Cloud - Store your entire photo, video and music collection; access from anywhere with fast 282 MB/s transfer speeds
- Creator-Grade Backup Solution - Protect your irreplaceable content with automated backups to cloud services, external drives and remote NAS
- Multi-Layered Data Protection - Combine RAID redundancy, automated backups and snapshot technology to prevent data loss from any cause
- Smart Home Surveillance - Support up to 30 IP cameras with AI detection, instant alerts and secure remote monitoring
Locate the document root first
The document root is the directory whose contents are served for the site’s domain. Common names include public_html, httpdocs or a domain-specific folder, but the correct path is host-dependent. In the host’s File Manager, look for the directory containing wp-admin, wp-content and wp-includes. If those folders are inside a subdirectory, that subdirectory—not its parent—is the WordPress installation directory you should use when scoping the file account.
Keep the two credential sets distinct
- FTP/SFTP account: reaches files, with access limited to the WordPress directory whenever the host permits.
- Database user: reads and writes WordPress tables in one database; it does not automatically provide file access.
- Hosting-panel login: controls the account and often has broader powers than either service account. Do not reuse it for routine transfers.
Choose SFTP over plain FTP when available
SFTP runs through SSH and encrypts the password and transferred data in transit. WordPress describes it as FTP-like file transfer with encryption between your computer and the website. Plain FTP sends credentials and data without that protection. Some providers instead offer FTP over SSL (often called FTPS); that is a different protocol from SSH-based SFTP, so select the protocol your host explicitly documents.
Free tools Windows power users keep installed
One-click scans. No signup required.
Encryption does not make an SFTP account harmless. Documentation for managed WordPress environments notes that SSH/SFTP credentials can add, modify and remove site files and settings and generally cannot be restricted to individual actions. Treat them as administrative access, store them in a password manager, and remove or rotate them when a person or service no longer needs access.
What to collect from the host
- Protocol: SFTP, FTPS or FTP, with SFTP preferred.
- Server name or IP address and the port supplied by the host. SSH SFTP commonly uses a different port from plain FTP, so do not guess.
- Username, password or SSH-key requirement.
- Initial directory and the path that contains the WordPress folders.
- Whether the provider has disabled FTP and expects File Manager or SFTP instead.
Create a dedicated, directory-scoped file account
cPanel
- Sign in to cPanel and open FTP Accounts. cPanel describes this interface as the place to create and manage website FTP accounts.
- Enter a descriptive login, such as one used only for this site or deployment task. Do not use the hosting-panel administrator’s password.
- Generate a long, unique password or use the provider’s password generator.
- Set the Directory field to the WordPress installation path identified earlier. Confirm that the panel did not append an unintended extra folder to the path.
- Create the account, then record the complete username. Some panels display a domain-qualified username rather than the short name you entered.
- Use the host’s displayed server, port and protocol values in your SFTP or FTP client. If the provider has disabled FTP, use its File Manager or the SFTP option instead of trying to enable an unapproved service.
Plesk and other panels
Plesk exposes an equivalent flow under its website or subscription file-transfer settings: add a separate FTP account, assign a home directory, and save a unique password. Other panels may call the field Home directory, Root directory or Access to server over FTP. Choose the directory containing wp-admin, wp-content and wp-includes, and disable shell access unless the host requires it for SFTP.
Rank #2
- Entry-level NAS Personal Storage：UGREEN NAS DH2300 is your first and best NAS made easy. It is designed for beginners who want a simple, private way to store videos, photos and personal files, which is intuitive for users moving from cloud storage or external drives and move away from scattered date across devices. This entry-level NAS 2-bay perfect for personal entertainment, photo storage, and easy data backup (doesn't support Docker or virtual machines).
- Set Your Devices Free, Expand Your Digital World: This unified storage hub supports massive capacity up to 64TB.*Storage drives not included. Stop Deleting, Start Storing. You can store 22 million 3MB images, or 2 million 30MB songs, or 43K 1.5GB movies or 67 million 1MB documents! UGREEN NAS is a better way to free up storage across all your devices such as phones, computers, tablets and also does automatic backups across devices regardless of the operating system—Window, iOS, Android or macOS.
- The Smarter Long-term Way to Store: Unlike cloud storage with recurring monthly fees, a UGREEN NAS enclosure requires only a one-time purchase for long-term use. For example, you only need to pay $459.98 for a NAS, while for cloud storage, you need to pay $719.88 per year, $2,159.64 for 3 years, $3,599.40 for 5 years. You will save $6,738.82 over 10 years with UGREEN NAS! *NAS cost based on DH2300 + 12TB HDD; cloud cost based on 12TB plan (e.g. $59.99/month).
- Blazing Speed, Minimal Power: Equipped with a high-performance processor, 1GbE port, and 4GB RAM on Board, this NAS handles multiple tasks with ease. File transfers reach up to 125MB/s—a 1GB file takes only 8 seconds. Don't let slow clouds hold you back; they often need over 100 seconds for the same task. The difference is clear.
- Let AI Better Organize Your Memories: UGREEN NAS uses AI to tag faces, locations, texts, and objects—so you can effortlessly find any photo by searching for who or what's in it in seconds. It also automatically finds and deletes similar or duplicate photo, backs up live photos and allows you to share them with your friends or family with just one tap. Everything stays effortlessly organized, powered by intelligent tagging and recognition.
Verify the scope before using the account
Connect with the newly created account and confirm that the initial listing is the intended WordPress directory. You should be able to see the site’s WordPress folders but not unrelated domains, backups or other customers’ directories. Try creating a harmless test file in a staging or temporary subdirectory only if your host permits it, then remove it. A login that lands one level too high is a directory-scope error, not a WordPress configuration problem.
Create the WordPress database and user
cPanel MySQL Database Wizard
- Open MySQL Database Wizard in cPanel.
- Create a database with a clear, site-specific name. cPanel may prepend your hosting account name, so note the full name exactly as displayed.
- Create a database user and generate a strong, unique password. Again, record the full username, including any account prefix.
- Use the wizard’s step that adds the user to the database. Select only the privileges required for WordPress operation, or choose the host’s documented default and review it before saving.
- Copy the final database name, database username, password and database-host value into a secure password manager. The name and user shown in the panel must be copied exactly, including prefixes and capitalization where the host treats them as significant.
Plesk and equivalent interfaces
In Plesk, open the site’s Databases area, create a database, add a database user and attach that user to the database. The labels differ among providers, but the required result is the same: one database dedicated to this WordPress installation and one password-protected user assigned to it.
Do not confuse a database name with a database user
The database name identifies the data container; the user is the credential allowed to connect to it. They may look similar because a host adds the same account prefix to both. WordPress needs both values separately, plus the password and server address. Entering the database name in the user field, or omitting a provider-added prefix, produces a connection failure even when the password is correct.
Put the exact values in wp-config.php
Make a backup of wp-config.php before editing it. The file is normally in the WordPress installation directory, alongside wp-admin and wp-content. Edit it through the host’s editor, a secured SFTP connection or SSH; do not paste its contents into a public ticket, screenshot or shared document.
Rank #3
- 【Advanced Home Data & Media Hub】For advanced home users who need phone backup, file storage, and centralized data management. Centralize family photos, 4K videos, movies, computer backups, and personal files in one place while running multiple apps for home entertainment and everyday data management. Suitable for households with growing digital libraries and multiple NAS use cases.
- 【Built for Creators, Media Servers & Advanced Apps】Powered by the Intel N100 Quad-Core CPU, 8GB DDR5 RAM, 2.5GbE networking, and dual M.2 NVMe slots, DXP2800 handles large files and heavier workloads with ease. Run Docker, virtual machines, and media server applications compatible with Plex—ideal for content creators, tech enthusiasts, and advanced home users managing 4K videos, RAW photos, personal media libraries, and multiple NAS apps.
- 【Up to 80TB for Growing Digital Libraries】 Supports up to 80TB of storage using two HDD bays and two M.2 NVMe SSD slots for family photos, movies, RAW photos, 4K videos, work files, and device backups. AI photo management supports recognition of people, objects, scenes, and locations, album organization, and duplicate photo detection. HDDs and SSDs are not included.
- 【AI-powered Home Surveillance】Turn DXP2800 into a centralized home surveillance hub by connecting compatible network cameras and storing recordings locally on your NAS. AI-powered features include Face Recognition, People Detection, and Pet Detection, helping advanced home users review important events more efficiently while managing home surveillance and personal data in one place.
- 【One data Center Across Your Devices】Keep files from desktops, laptops, phones, tablets, and other devices together instead of scattered across cloud accounts and external drives. Access, back up, organize, and share data across Windows, macOS, Android, iOS, web browsers, and compatible smart TVs—ideal for creators and advanced home users working across multiple devices.
Set these four constants to the values supplied by the host:
define( 'DB_NAME', 'full_database_name' );
define( 'DB_USER', 'full_database_user' );
define( 'DB_PASSWORD', 'database_password' );
define( 'DB_HOST', 'database_host' );Replace every example value, including DB_HOST. Some hosts use localhost; others provide a separate database server name or address. The host panel’s value is authoritative. Do not add spaces or quotation marks inside the value, and preserve the surrounding PHP syntax.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteSave the file without changing its encoding or removing the opening PHP tag. A syntax error can make the entire site fail before WordPress can display a useful message. If the panel offers a syntax-aware editor, use it; otherwise make one change at a time and keep the backup available for rollback.
Grant only the database privileges WordPress normally needs
For ordinary operations—publishing posts, uploading media, accepting comments, creating WordPress users and installing plugins—the WordPress hardening guidance identifies four data privileges: SELECT, INSERT, UPDATE and DELETE. These allow WordPress to read and change rows without granting unrestricted database administration.
Rank #4
- Secure private cloud - Enjoy 100% data ownership and multi-platform access from anywhere
- Easy sharing and syncing - Safely access and share files and media from anywhere, and keep clients, colleagues and collaborators on the same page
- Automated Backup Protection - Set-and-forget backups for Macs, PCs and mobile devices to multiple destinations including cloud and external drives
- Home Security System - Record and monitor your property 24/7 with support for multiple IP cameras and remote viewing
- 2-Year Warranty - Reliable hardware backed by Synology's expert customer support team and ongoing software updates
Some plugin or upgrade workflows may require schema changes, such as creating or altering tables. Follow the plugin or host’s documented requirement rather than permanently giving every application user administrative rights. If elevated privileges are temporarily necessary, grant them for the maintenance window, perform the operation, and remove them afterward when your panel supports that level of control.
| Privilege | Normal WordPress purpose | Guidance |
|---|---|---|
SELECT |
Reads posts, settings, users and other stored data | Required for normal operation |
INSERT |
Adds posts, comments, users and plugin records | Required for normal operation |
UPDATE |
Changes settings and existing records | Required for normal operation |
DELETE |
Removes records when WordPress or an administrator does so | Required for normal operation |
| Administrative or schema privileges | Creates, alters or drops database structures | Not part of the normal four; grant only when a documented task requires them |
Fix ownership and write permissions before testing updates
File mode numbers alone do not determine whether WordPress can update itself. The files must also be owned by the account or group under which PHP runs. WordPress’s permissions guidance notes that hosting arrangements differ: on one server PHP may run as the site owner, while on another it may run through a web-server group or an isolated pool.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsAsk the host which ownership and permission scheme it supports instead of applying a blanket, world-writable setting. Overly broad write permissions expose configuration and plugin files to other processes. If PHP can read the installation but cannot write to it, WordPress may ask for FTP credentials during an update. That prompt is usually evidence of an ownership or write-path mismatch, not proof that the database credentials are wrong.
A safe diagnostic sequence
- Check the owner and group shown by the host’s File Manager or shell for
wp-contentand the files WordPress is trying to update. - Compare them with the PHP user or the hosting plan’s documented ownership model.
- Confirm that the relevant directories are writable under that model, without making the entire account writable by everyone.
- If you cannot change ownership yourself, give the host the exact path and the update error and ask it to align PHP ownership.
- After the host corrects ownership, retry a small, controlled update. Keep the dedicated SFTP account available as a fallback, but do not use it to hide a persistent permission defect.
Test both services in a controlled order
- Test the file login: connect with the dedicated SFTP or FTP account, verify the protocol and port, and confirm that the starting directory is the WordPress root.
- Test a file operation: list files, download a non-sensitive file, and—only where appropriate—upload and remove a harmless test file. Confirm that the account cannot browse outside its assigned scope.
- Test the database values: if shell access is provided, cPanel documents testing a username and password with
mysql -u db_user -p. Enter the password when prompted; do not put it directly in a shell command that may be saved in history. Use the full host-created username and connect to the intended database when the client requests it. - Load WordPress: open the front end and the login page. A database connection error at this stage points to the four values in
wp-config.phpor to a database-service problem. - Run a limited maintenance action: update one plugin or upload one small media file while watching for permission errors. Confirm that the change appears on the site, then remove any test artifact.
- Revoke temporary access: delete test accounts, rotate shared credentials and close any temporary firewall or shell exception created for the check.
Secure the credentials and configuration
- Use separate passwords for the hosting panel, SFTP/FTP account and database user. A leak in one service should not automatically unlock the others.
- Scope the file account to the site directory whenever the host permits it. A narrowly scoped account limits damage from an exposed password.
- Prefer SFTP, but handle its keys or passwords as highly privileged administrative credentials. Limit who receives them and rotate them after staff or contractor access ends.
- Protect
wp-config.php; it contains the database connection values. Keep backups encrypted and out of publicly served directories. - Never send database passwords or SFTP secrets in support tickets, chat transcripts, screenshots or shared documents. Use the host’s secure credential-sharing mechanism if one exists.
- Maintain an offline recovery path: a recent database backup, a copy of the original configuration and a documented way to reach the host when the site is unavailable.
Troubleshoot by symptom
“Error establishing a database connection”
- Open the host panel and copy the full database name and full database username again, including any account prefix.
- Compare them character-for-character with
DB_NAMEandDB_USERinwp-config.php. - Reset the database user’s password in the panel if necessary, then update
DB_PASSWORDwith the new value. - Verify
DB_HOSTagainst the host’s documented database server. Do not assume thatlocalhostis correct. - Confirm that the user is attached to this database and has at least
SELECT,INSERT,UPDATEandDELETE. - If all values match, ask the host whether the database service is running or whether connections from the web server are restricted.
WordPress keeps asking for FTP credentials
Inspect file ownership and write permissions first. WordPress uses the direct PHP write method only when the server allows it; otherwise it requests a supported FTP or SFTP method. Correct the ownership model with the host, then enter the dedicated account’s protocol, server, port, username and password if a transfer login is still required. Do not respond by making every file world-writable.
Best Value
- One Place for All Your Data - Consolidate scattered files from multiple computers, phones and external drives into one accessible hub with 100% ownership
- Professional File Collaboration - Share projects with clients, sync documents across teams and maintain version control without Dropbox fees
- Automated Backup Protection - Set-and-forget backups for Macs, PCs and mobile devices to multiple destinations including cloud and external drives
- DIY Surveillance System - Transform IP cameras into a professional monitoring solution with motion alerts, recording schedules and remote viewing
- 2-Year Warranty - Reliable hardware backed by Synology's expert customer support team and ongoing software updates
The FTP/SFTP login opens the wrong directory
Return to the panel’s FTP account settings and correct the home or directory field to the folder containing wp-admin, wp-content and wp-includes. Some panels append the account name to a path automatically; inspect the resulting full path and reconnect after saving.
The host offers no FTP option
FTP may be disabled by the provider. Use SFTP if it is available, or use the host’s File Manager for occasional operations. If neither is offered, ask the provider which supported deployment or file-transfer method replaces FTP; do not expose an unapproved service on your own.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →The database test works, but the site still fails
Check for a typo or syntax error elsewhere in wp-config.php, an incorrect table prefix, exhausted database resources or a plugin that requires a schema change. Restore the last known-good configuration if the failure began immediately after editing, then reapply one verified change at a time.
Evaluate a host or control panel before creating the accounts
If you are choosing hosting, compare operational capabilities rather than a brand name. The following questions predict whether setup and recovery will be straightforward:
Quick Recap
| Capability | Why it matters | What to confirm |
|---|---|---|
| SFTP support versus plain FTP | Determines whether credentials and transfers are encrypted in transit | Protocol, port, key support and whether SSH access is required |
| Directory-scoped file accounts | Limits an exposed account to one site | Whether the panel lets you set a precise home or document-root path |
| Database-user privilege controls | Supports least-privilege access | Whether users can be attached to one database and privileges reviewed or changed |
| Clear document-root display | Prevents logins that land in the wrong site | How the panel shows the full path for each domain or subscription |
| File Manager fallback | Provides access when FTP is disabled or unavailable | Whether edits, uploads and permission checks are available in the panel |
| PHP/file ownership configuration | Allows direct WordPress updates without avoidable credential prompts | Which account runs PHP and how the provider repairs ownership |
Final setup checklist
- The installation is self-hosted, and you have identified the directory containing the three WordPress core folders.
- A dedicated SFTP account exists, or the host’s approved FTP/File Manager alternative is documented.
- The file account starts in the WordPress directory and cannot browse unrelated sites.
- A dedicated database and database user exist, with the full host-created names recorded.
wp-config.phpcontains matchingDB_NAME,DB_USER,DB_PASSWORDandDB_HOSTvalues.- The database user has the normal data privileges—
SELECT,INSERT,UPDATEandDELETE—and no unnecessary administrative access. - Ownership and write permissions match the host’s PHP execution model.
- File login, database login, site loading and one controlled update have all been tested.
- Secrets are stored privately, backups are protected and temporary access has been removed.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
