How to Fix WordPress Asking for FTP Credentials During Updates

WordPress prompts for “Connection Information” (FTP hostname, username, and password) every time you try to install a plugin, update a theme, or upgrade the core. This DevAnswers guide explains exactly why the prompt appears and walks through three methods to fix it permanently, starting with the most secure approach.

Why WordPress Asks for FTP Credentials #

Before WordPress writes any file to disk, it runs a safety check. The get_filesystem_method() function creates a temporary file inside wp-content/ and compares its owner against the owner of the WordPress core files. If the owners match, WordPress knows the PHP process can safely write files directly and uses the direct filesystem method. If they do not match, WordPress falls back to FTP/SFTP and shows the credentials prompt.

This ownership mismatch is the root cause in almost every case. It typically happens when WordPress files are owned by one user (the account used to upload them via FTP or SSH) while the PHP process runs as a different user (commonly www-data on Ubuntu/Debian or apache on CentOS/RHEL).

If the ownership test fails, WordPress checks for available transport methods in priority order: SSH2, FTP PHP Extension, then FTP Sockets. It picks the first one whose PHP extension is loaded and displays the credentials prompt. If you have defined FTP_USER, FTP_PASS, and FTP_HOST constants in wp-config.php, WordPress fills them in automatically and skips the prompt. But the cleanest approach is to fix the ownership so the test passes in the first place.

The table below summarises which method to use based on your hosting environment:

Method 1: Fix File Ownership (Recommended) #

The proper fix is to align file ownership so the PHP process user matches the owner of the WordPress files. This lets WordPress pass its built-in ownership test naturally, without bypassing any security checks or storing credentials in plain text. You need SSH access to your server for this method, but it is a one-time fix that works permanently.

First, find out which user your web server runs as:

ps aux | grep -E 'apache|httpd|nginx|php-fpm' | grep -v grep

Look at the first column of the output. On most Ubuntu and Debian servers running Apache or Nginx with PHP-FPM, the process user is www-data. On CentOS or RHEL systems, it is typically apache or nginx.

Once you know the correct user, change ownership of the entire WordPress installation:

sudo chown -R www-data:www-data /var/www/html

Replace www-data:www-data with your web server’s user and group if different, and /var/www/html with the path to your WordPress installation.

Verify the ownership change took effect:

ls -la /var/www/html/wp-content/

Every file and directory should now show www-data www-data (or your web server user) in the owner and group columns. Go back to WordPress and try your update again. The FTP prompt should be gone.

Method 2: Set FS_METHOD to Direct #

If you cannot change file ownership (no SSH access, or your host restricts chown), you can tell WordPress to skip the ownership test entirely. Open wp-config.php in the WordPress root directory and add this line above the /* That's all, stop editing! */ comment:

define('FS_METHOD', 'direct');

This forces WordPress to use direct filesystem writes regardless of who owns the files. You can also define the permissions WordPress uses when creating new files and directories:

define('FS_METHOD', 'direct');
define('FS_CHMOD_DIR', 0755);
define('FS_CHMOD_FILE', 0644);

Method 3: Hardcode FTP Credentials #

On shared hosting where you have no SSH access and FS_METHOD = 'direct' does not work (you get “Could not create directory” errors), you can hardcode your FTP credentials into wp-config.php. WordPress reads these constants and fills in the credentials form automatically, so you never see the prompt.

define('FTP_USER', 'your_ftp_username');
define('FTP_PASS', 'your_ftp_password');
define('FTP_HOST', 'localhost');

Replace your_ftp_username and your_ftp_password with your actual FTP credentials. The host is usually localhost if the FTP server runs on the same machine. If your host uses a non-standard port, append it with a colon: ftp.example.com:2121.

If your server supports FTPS (FTP over SSL), add:

define('FTP_SSL', true);

Security Considerations #

The ownership test that WordPress performs exists to protect sites on shared hosting. On a typical shared server, every customer’s PHP process executes as the same system user (often apache or www-data). When you set FS_METHOD = 'direct', any plugin or theme installed on your site becomes owned by this shared user. A malicious account on the same server could write a PHP script that modifies your plugin files and injects code into your site.

On a VPS or dedicated server, you are the only user, so this shared-user attack vector does not exist. FS_METHOD = 'direct' is safe in that context.

Hardcoding FTP credentials in wp-config.php (Method 3) carries its own risk: if an attacker gains read access to that file through a vulnerability, they obtain your FTP password. Lock down the file permissions to mitigate this:

sudo chmod 440 /var/www/html/wp-config.php

This sets wp-config.php to read-only for the owner and group, with no access for others. The WordPress documentation recommends 440 or 400 for this file.

Conclusion #

The FTP credentials prompt is caused by a mismatch between the PHP process owner and the WordPress file owner. Fixing file ownership with chown is the cleanest solution because WordPress passes its own safety check and no credentials are stored in plain text. If you lack SSH access, FS_METHOD = 'direct' works on VPS and dedicated servers, while hardcoded FTP credentials remain an option for restrictive shared hosting environments.