If WordPress asks for FTP credentials whenever you update a plugin, the usual cause is a mismatch between the account that owns the WordPress files and the account running PHP. Fix the ownership and group permissions for the correct installation—or deliberately use secure SFTP/FTP credentials on a shared host. Do not assume the answer is always www-data, and do not “fix” the problem with 777 permissions.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
Start with a backup, identify the real PHP execution account, inspect the document root and plugin directory, then apply only the ownership change your hosting model requires. This approach restores dashboard updates without weakening the site’s security boundary.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
WordPress Multisite Administration | $34.38 | Buy on Amazon |
| 2 |
|
Mon Site WordPress – Volume 2 – Administration & Utilisation (French Edition) | $9.90 | Buy on Amazon |
| 3 |
|
WordPress 24-Hour Trainer | $3.95 | Buy on Amazon |
| 4 |
|
Teacher Record Book | $4.89 | Buy on Amazon |
As an Amazon Associate I earn from qualifying purchases.
Why WordPress asks for FTP credentials
When you click Update for a plugin, WordPress must download an archive, unpack it, remove or replace the old plugin files, and write the new files into wp-content/plugins. Before doing that, its Filesystem API checks whether the PHP process can create and modify files with suitable ownership.
If the process can write directly, WordPress uses direct filesystem I/O and the update normally completes in the dashboard. If it cannot, WordPress falls back to a filesystem method that asks for FTP, FTPS, SFTP, or SSH credentials. The prompt is therefore a symptom of an access mismatch, not evidence that the plugin itself necessarily failed.
#1 Best Overall
WordPress documentation describes the rule this way: it determines the filesystem connection method from the ownership of the WordPress files. When the files belong to the user running the web server, and newly created files will inherit that user, WordPress can modify them without asking for credentials.
The names of the relevant accounts vary. A Linux server may use www-data, apache, httpd, nobody, a PHP-FPM pool user, or a per-site hosting account. On shared hosting, the safest design may intentionally keep files owned by your hosting or SFTP account while WordPress connects through those credentials.
Recommended Free Tools
Choose the ownership model before changing anything
There is no universal owner that is correct for every WordPress installation. Match the repair to who runs PHP, who administers the site, and whether other customers or sites share the server.
| Model | File owner or group | Update method | Security and operational trade-off |
|---|---|---|---|
| Single-user server | The account running PHP owns the files, or belongs to a group with the required write access. | Direct dashboard update. | Convenient, but a compromised web process can alter files it owns. Keep permissions limited to the site. |
| Per-site PHP-FPM account | The site’s PHP-FPM user owns the installation, often with an administrator in the same group. | Direct dashboard update. | Separates sites from one another when pools and directory permissions are configured correctly. |
| Shared hosting | The hosting or FTP/SFTP account commonly remains the owner; the provider controls the web process. | SFTP, FTPS, or the host’s supported Filesystem API method. | Preserves the provider’s isolation model. A local chown may be unavailable or may break the account. |
| Plain FTP fallback | Ownership remains unchanged. | FTP credentials entered in WordPress. | FTP is not encrypted. Prefer SFTP or FTPS whenever the host offers it. |
Do not change ownership merely to remove a prompt. If your host deliberately separates the web process from the account that owns your files, using the host’s SFTP or FTPS method may be the least-privilege choice.
Safe repair workflow
1. Back up the site and confirm the document root
Create a current backup of both the database and the site files. A plugin update can fail midway, and an ownership command applied to the wrong directory can affect an entirely different site.
- Confirm the active domain’s document root in your control panel or virtual-host configuration.
- Record the locations of
wp-config.php,wp-content, andwp-content/plugins. - Keep a second copy of the backup outside the web root.
Use the control panel, SFTP, SSH, or file manager your host documents. Never infer the path from a tutorial for another server.
2. Identify the account that runs PHP
Find the user attached to the PHP or web-server process for this site. On a server you administer, process listings can show likely accounts:
ps -eo user,group,comm | egrep 'php-fpm|php-cgi|apache2|httpd|nginx'PHP-FPM pool configuration is more authoritative than a generic web-server process. Inspect the pool serving this virtual host and note its user and group settings. On managed or shared hosting, ask support which account executes PHP; you may not have permission to inspect it yourself.
Do not assume that the account shown for Nginx or Apache is the account that writes PHP files. A reverse proxy can run as one user while PHP-FPM runs as another.
3. Inspect ownership, groups, and directory traversal
Check the WordPress directory, wp-content, and the plugins directory, including every parent directory that PHP must traverse:
namei -l /var/www/html/wp-content/plugins
stat -c '%U %G %a %n' /var/www/html /var/www/html/wp-content /var/www/html/wp-content/plugins/var/www/html is only an example path; use the confirmed document root for your site. The output gives you the owner, group, and mode. A directory can look writable while a parent directory blocks traversal, or the plugin directory can be writable while existing plugin files are owned by a different account.
Look for a consistent, intentional pattern. On a direct-update installation, the PHP execution account should either own the relevant files or have group write access. On a shared installation, the owner may be your hosting account, with WordPress expected to use SFTP or another provider-supported method.
4. Apply the smallest host-approved ownership change
Use your provider’s documented chown, chgrp, ACL, or control-panel permission procedure. A typical administrator-managed server might use a command shaped like this:
sudo chown -R siteuser:webgroup /var/www/htmlThat command is an example of syntax, not a universal prescription. Substitute only accounts and paths you have verified, and do not run it recursively across a parent directory containing unrelated sites, system files, backups, or mounted storage.
If the design uses a shared group, add the PHP account to the approved site group or assign group ownership according to the host’s instructions. Confirm that newly created files inherit the intended group; otherwise the first update may work while later updates fail again.
Do not use recursive permission changes as a substitute for understanding ownership. In particular, never apply chmod -R 777. World-writable files allow other users or compromised processes on the server to alter WordPress, plugins, and uploads.
Rank #3
5. Test the exact write operation
After changing ownership, verify that the PHP account can create and remove a temporary file in the relevant directory. Perform this through a controlled maintenance script or the host’s diagnostic tool, then remove the test file immediately. Do not leave a publicly reachable test script in the web root.
Also check practical blockers:
- The filesystem is mounted read-only.
- The disk or inode quota is full.
- SELinux, AppArmor, or another mandatory-access policy denies the write.
- The plugin directory is a symlink to a location with different ownership.
- An immutable file attribute prevents replacement.
Correct the underlying host configuration rather than loosening every permission.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →6. Retry the update
In the WordPress dashboard, open Plugins, select the affected plugin, and choose Update Now. A successful direct update should download, unpack, replace the plugin, and return you to the plugins screen without a credentials prompt.
If the host’s model requires credentials, enter the correct account and server details instead. Prefer SFTP or FTPS over unencrypted FTP. The hostname, port, username, and remote path must match the hosting account; WordPress credentials are not necessarily the same as your dashboard login.
7. Remove a stale maintenance marker
WordPress creates a temporary .maintenance file during updates. If an update was interrupted, the file can leave the site showing a maintenance or failed-update message even after permissions are repaired. Connect with FTP, SFTP, SSH, or the host file manager, remove .maintenance from the WordPress directory, and reload the site. Delete only that marker after confirming no update is still running.
What not to do
Do not force FS_METHOD=direct just to hide the prompt
Setting FS_METHOD to direct can suppress the credentials request, but it does not grant safe access. If PHP cannot legitimately write the files, forcing direct mode can produce failed updates or encourage unsafe permissions. WordPress documents that direct file I/O can be unsafe on poorly configured hosts. Fix the ownership model or use the supported transport instead.
Free tools Windows power users keep installed
One-click scans. No signup required.
Do not make the entire installation world-writable
777 grants read, write, and execute permissions to everyone who can access the filesystem. It can allow another account or compromised service to inject code into plugins, themes, or core files. A working update is not worth creating that exposure.
Do not recursively change unrelated paths
A command aimed at /var/www, a home directory, or the server root can damage multiple sites and services. Restrict changes to the confirmed WordPress document root and keep a record of the original owner and group.
Rank #4
- Keep track of everything from attendance to test scores
- Spiral bound
- Measures 8-1/2" x 11"
Troubleshooting when the prompt remains
The owner looks correct, but WordPress still asks for credentials
Recheck the PHP-FPM pool serving this domain. The command-line PHP user, the web-server user, and the PHP-FPM user can differ. Then inspect parent-directory execute permission, symlinks, ACLs, read-only mounts, and security-policy logs. A single unwritable directory inside wp-content can trigger the fallback.
Only one plugin fails
Inspect that plugin’s directory and files separately. A previous manual upload, deployment tool, or failed update may have left one subtree owned by a different account. Compare it with another working plugin before changing anything.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsUpdates work once and fail later
New files may be created with a different owner or group than the files they replaced. Review the PHP-FPM umask, directory set-group behavior, and the host’s documented inheritance rules. The goal is for every future update to produce files that the same approved account can replace.
You cannot run chown
That is normal on many shared hosts. Do not attempt to bypass the restriction. Use the provider’s file manager or SFTP/FTPS credentials, or ask support to confirm the execution account and repair the site’s ownership within its isolation model.
The update fails with a disk or permission error after ownership is fixed
Check available disk space and inode usage, PHP temporary-directory permissions, upload limits, and security-policy denials. WordPress must be able to download and unpack the archive as well as replace the final plugin directory.
Direct updates versus SFTP or FTP
The right choice depends on more than convenience. Evaluate the account that owns files, the account that runs PHP, whether the host is shared, whether the connection is encrypted, and whether the arrangement limits damage if a process is compromised.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
| Question | Direct filesystem method | SFTP/FTPS or FTP method |
|---|---|---|
| Who writes files? | The PHP process writes locally. | The authenticated file-transfer account writes remotely. |
| Best fit | A server where the PHP account is intentionally permitted to manage the site. | Shared hosting or installations where the administrative account must remain the owner. |
| Encryption | No network transfer is required for the filesystem operation. | SFTP and FTPS encrypt the connection; plain FTP does not. |
| Main risk | An overly privileged or compromised web process can modify more than intended. | Storing or entering incorrect credentials, especially over plain FTP, can expose access. |
| Maintenance | Requires correct ownership, groups, and host security policy. | Requires working credentials, server details, and an accessible remote path. |
When to get server-permissions help
Ask your host or a server administrator for assistance when you cannot identify the PHP execution account, multiple sites share the same directory tree, the provider controls SELinux or PHP-FPM, or a recursive ownership change could affect production services. Provide the domain, confirmed document root, affected directory, exact error text, and the time of the failed update. Do not send passwords in a support ticket.
A competent administrator should be able to explain which account owns the files, which account runs PHP, why the selected update method is appropriate, and how the fix preserves least privilege. If those answers are unclear, changing permissions blindly is more dangerous than continuing to use the host’s supported SFTP or FTPS workflow.
Quick Recap
Final checklist
- Back up the database and files.
- Confirm the correct document root.
- Identify the PHP execution account, not just the web-server account.
- Inspect ownership and traversal permissions for the site,
wp-content, and plugins. - Choose direct updates only when the host’s ownership model supports them.
- Use SFTP or FTPS when the hosting account should remain the owner.
- Apply only documented, narrowly scoped ownership or group changes.
- Never use
777as a blanket fix. - Retry the update and remove a stale
.maintenancefile if an interrupted update left one behind.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
