FS_METHOD tells WordPress which filesystem transport to use when it must read, write, modify, or delete files. That includes automatic updates for WordPress core, plugins, themes, and language packs. Its accepted values are direct, ssh2, ftpext, and ftpsockets.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
Most sites should leave the constant undefined. WordPress tests whether the PHP process can safely write the installation and normally selects the best available method. Add a forced value only when a specific permissions, ownership, or update problem requires it—and remove the override if it does not solve that problem.
As an Amazon Associate I earn from qualifying purchases.
What FS_METHOD controls
WordPress uses its Filesystem API for operations that change files on the server. The API is involved when the dashboard installs or updates core files, plugins, themes, and language packs, and it can also be used by other administrative operations that need to read, write, modify, or delete files.
The FS_METHOD constant does not install an FTP server, repair permissions, or create an SSH account. It is only a selection override. It tells WordPress which transport to attempt for those filesystem operations.
Add the setting to wp-config.php before the line that says WordPress should stop editing the file. The standard syntax is:
define( 'FS_METHOD', 'direct' );Replace direct with one of the other documented values only when that transport matches the server and the problem you are fixing.
How WordPress selects a filesystem method
When no override is present, WordPress’s get_filesystem_method() routine evaluates the available options. Its documented preference order is:
- Direct PHP file access.
- SSH2.
- PHP FTP extension.
- FTP sockets, using the sockets class or functions such as
fsockopen().
WordPress first considers whether the web-server/PHP process can write the relevant files with compatible ownership and permissions. It then considers remote transports that the server can actually provide and the required PHP support that is installed. A defined FS_METHOD takes precedence over that automatic result.
There is also a filesystem_method filter that can override the result in code. If a plugin, host configuration, or custom code uses that filter, changing wp-config.php may not produce the method you expect. For a normal site, the constant is the simplest and most visible override.
The four valid FS_METHOD values
| Value | How it connects | What must be available | When it fits | Important limitation |
|---|---|---|---|---|
direct |
PHP reads and writes files directly through the local filesystem. | The PHP process must own, or have safe write access to, the WordPress files and directories it needs to change. | A server with correctly aligned ownership and permissions. | Direct access can create security problems on a poorly configured host. |
ssh2 |
WordPress uses the SSH2 PHP extension. | The SSH2 extension, an SSH service, and connection details or keys supplied through the related FTP configuration constants. | A host that provides SSH access and has the required PHP extension enabled. | SSH2 is not ordinary FTP and is not enabled merely by setting FTP_SSL. |
ftpext |
WordPress uses PHP’s FTP extension. | The PHP FTP extension plus a working FTP service and its connection credentials. | A host whose supported update route is FTP through the PHP extension. | The extension and server protocol must both be available; the constant cannot create either one. |
ftpsockets |
WordPress uses socket-based FTP through the sockets class or functions such as fsockopen(). |
Socket support and a reachable FTP service with the necessary credentials. | A fallback when the normal PHP FTP extension is unavailable or incompatible with the server. | It remains FTP over sockets, not SSH or SFTP. |
The table describes transport choice, not a ranking you should set manually. WordPress’s normal order is designed to avoid remote credentials when safe local access is available.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Why WordPress asks for FTP credentials
The FTP prompt usually means WordPress cannot safely modify the files as the account running PHP. A common cause is a mismatch between the file owner and the web-server/PHP account, or a directory that is not writable by that process. WordPress detects that condition while preparing an update and offers a remote filesystem transport instead.
The prompt is therefore not proof that WordPress is broken and not proof that FTP is required for every operation. It is a consequence of the server’s ownership, permission, PHP-library, and available-service combination. If the host has SSH rather than FTP, the appropriate method may be ssh2; if it exposes only a compatible FTP path, WordPress may use ftpext or ftpsockets.
Rank #3
Entering credentials can allow the update to proceed, but it does not correct the underlying ownership arrangement. On a site that repeatedly asks for credentials, treat the prompt as a configuration issue to investigate rather than a reason to keep adding constants at random.
Should you set define( 'FS_METHOD', 'direct' )?
Use a decision based on the observed server behavior:
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →- No prompt and successful updates: leave
FS_METHODundefined. Automatic detection is already working. - The PHP account owns the files and can write them safely, but WordPress chooses another method: a temporary
directtest may confirm the diagnosis. Keep it only if it resolves the specific issue and the host’s permissions are properly managed. - The PHP account cannot own or write the files: forcing
directwill not fix the ownership boundary. Use the remote method the host actually supports, or have the host correct ownership and permissions. - A forced value made updates fail: remove the constant and let WordPress detect a method again, then review the server’s supported extensions and services.
WordPress specifically advises changing FS_METHOD mainly for update problems. A setting copied from another site is not automatically appropriate for yours: two hosts can run the same WordPress version while using different PHP accounts, owners, permissions, and extensions.
How to configure a method safely
- Record the actual symptom. Note whether the dashboard requests FTP credentials, which update or file operation fails, and the complete error text. Do not begin by changing several constants at once.
- Check the server arrangement. Determine which account runs PHP, who owns the WordPress files, whether the required directories are writable by that account, and whether the host provides SSH or FTP. Confirm that the corresponding PHP extension is enabled.
- Remove stale overrides. Search
wp-config.phpand deployment configuration for an existingFS_METHODdefinition. Also account for code using thefilesystem_methodfilter. Two competing overrides make diagnosis harder. - Prefer automatic selection when it should work. If local ownership and permissions are correct, remove the constant and retry the update. WordPress can then test direct access before considering SSH2, the FTP extension, or FTP sockets.
- Force only the supported transport. If the host instructs you to use SSH2, FTP through the PHP extension, or socket FTP, define exactly that value:
ssh2,ftpext, orftpsockets. Do not substitute a protocol that merely sounds similar. - Supply connection data securely. Remote methods may need host, username, password, port, passive-mode, SSL, or key settings through the related FTP configuration constants. Keep secrets out of publicly served files, screenshots, tickets, and source repositories, and follow the host’s documented configuration process.
- Test one operation. Try the update or file action that originally failed. Confirm both that it completes and that the resulting files have the expected owner and permissions.
- Revert an unsuccessful experiment. If forcing the method does not help, remove the definition and investigate the server configuration instead of stacking additional overrides.
Understanding SSH2, FTP, SSL, and SFTP terminology
The names are easy to confuse. ssh2 means WordPress is using the SSH2 PHP extension and an SSH-based connection. ftpext and ftpsockets are FTP transports implemented through different PHP mechanisms.
FTP_SSL is a setting for secure FTP support in the underlying FTP transport. It does not turn FTP into SSH, and it does not select ssh2. A host that gives you SFTP instructions is describing an SSH-based service, while a host that gives you FTPS instructions is describing FTP protected with TLS. Choose the FS_METHOD value that corresponds to the service and PHP support the host actually provides.
Troubleshooting by symptom
The dashboard keeps asking for credentials
First verify ownership and write permissions for the WordPress directories involved. If the PHP account cannot write them, a direct override is the wrong remedy. Ask the host whether it expects SSH2, FTP through the PHP extension, or socket FTP, and use that supported route with its required credentials.
Forcing direct causes an update error
Remove the override and return to automatic detection. The failure indicates that the PHP process still lacks compatible write access, or that direct access is unsafe under the host’s setup. Correct the ownership arrangement or use the host’s remote transport instead.
ssh2 is defined but WordPress cannot connect
Check that the SSH2 PHP extension is installed for the PHP runtime serving the site, that an SSH service is reachable, and that the supplied host, port, credentials, or keys are valid. A normal FTP account will not satisfy an SSH2 connection.
ftpext is unavailable
Confirm that the PHP FTP extension is enabled in the same PHP environment WordPress uses. If the host does not provide it but does provide socket support, ftpsockets may be the documented fallback. If neither is available, the host must provide another supported method or repair local ownership.
An update succeeds but later operations fail
Check the owner and permissions of the newly created files and directories. A transport that can write one location may still lack access elsewhere, and mixed ownership can cause the next plugin, theme, or language update to prompt again.
Recommended Free Tools
Security and maintenance considerations
Direct access is convenient because it avoids storing or entering remote credentials, but WordPress warns that it can expose security problems on poorly configured hosts. The important question is not whether direct is shorter; it is whether the PHP account’s write access is deliberate, limited to what the site needs, and consistent with the host’s isolation model.
Remote methods shift the trust boundary to an SSH or FTP service. Use the host’s required authentication method, protect passwords and private keys, and remove obsolete credentials when a deployment or hosting account changes. Do not define a remote method merely to silence a prompt if the service is not maintained.
Keep a record of why a constant was added. During migrations, PHP changes, or ownership repairs, revisit the setting. Once automatic detection can safely select the correct method, removing the override reduces configuration that can become stale.
Common mistakes to avoid
- Assuming
FS_METHODfixes file ownership. It only chooses a transport. - Setting
directbecause it appears in a forum answer without checking which account runs PHP. - Using
ssh2for an FTP-only account, or treatingFTP_SSLas an SSH/SFTP selector. - Defining more than one method in different configuration files and then diagnosing the wrong value.
- Leaving a forced method in place after a host migration, PHP change, or permissions repair.
- Storing remote passwords or keys in an exposed location.
Quick reference checklist
- Is the problem an update or another Filesystem API operation?
- Can the PHP process safely write the affected files?
- Who owns the files and directories?
- Which of SSH2, the PHP FTP extension, or FTP sockets does the host support?
- Are the required credentials or keys configured securely?
- Have you removed an override that did not solve the original problem?
The Bottom Line
FS_METHOD is a transport override, not a permissions fix. Leave it undefined when WordPress can select direct safely; otherwise use the one remote method your host genuinely supports, and remove the override if it does not resolve the demonstrated update problem.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
