The quickest test is to update from Dashboard > Updates. If WordPress finishes without asking for credentials, it had usable direct filesystem access for that operation. If it opens a connection-information form for FTP or SSH details, direct writes were unavailable and WordPress is using—or needs you to provide—an alternate filesystem transport.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
Confirm the configuration in wp-config.php by checking FS_METHOD, then verify the result in Tools > Site Health. The four documented method values are direct, ssh2, ftpext, and ftpsockets. A separate FTP_SSL setting enables FTPS for the PHP FTP extension; FTPS is not the same protocol as SFTP.
As an Amazon Associate I earn from qualifying purchases.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11What the update prompt tells you
WordPress chooses a filesystem method according to whether the web-server process can write to the WordPress files with the required ownership. Matching ownership normally allows direct PHP writes. When ownership does not match, WordPress asks for connection credentials so it can update through another transport.
WordPress documentation says it determines the filesystem connection method based on the file ownership of the WordPress files.
The prompt is therefore a useful observation, but it does not by itself identify whether the alternate transport is FTP, FTPS, or SSH/SFTP. To identify the configured method, inspect the setting and the server capabilities.
A successful update is also only a point-in-time result. WordPress may have written one directory successfully while another directory has a different owner or permission mode. A plugin installed by a deployment tool, a theme copied by a different account, or a hosting migration can change ownership later. Treat the dashboard result as evidence about that operation, not a permanent guarantee for every future update.
Free tools Windows power users keep installed
One-click scans. No signup required.
Run a safe, three-part check
1. Back up before testing an update
Make a current backup of the database and files before changing update settings or starting an update. A backup gives you a recovery point if an update is interrupted or a permissions change leaves files inaccessible. Keep the backup somewhere separate from the web server and confirm that you know how to restore it before proceeding.
2. Start an update from the dashboard
- Sign in as an administrator.
- Open Dashboard > Updates.
- Start the pending WordPress, plugin, or theme update.
- Record what happens before entering anything in a credentials form.
| Observed result | What it establishes | What it does not establish |
|---|---|---|
| Update completes without a credentials form | Direct filesystem access was usable for that operation. | It does not prove that every directory, plugin, theme, or future update will have identical ownership. |
| A form asks for FTP or SSH information | Direct writes were unavailable for that operation, so an alternate filesystem path is required. | It does not identify the exact protocol until you inspect the configuration or ask the host. |
| The update fails after credentials are entered | The supplied transport, account, permissions, port, or server extension may not be usable. | It does not mean the WordPress core files are damaged. |
Do not repeatedly submit guessed credentials. A failed login can trigger hosting security controls, and a successful login with an account restricted to the wrong directory still cannot update WordPress.
3. Read the Site Health filesystem check
- Open Tools > Site Health.
- Review the filesystem or update-related check in the status results.
- A pass message says the installation does not require FTP credentials.
- A failure message says the installation prompts for FTP credentials because of file ownership.
Site Health is a second view of the update path. It reports whether credentials are required; it does not display every connection detail, such as the negotiated port or authentication mechanism. If Site Health passes but a particular plugin update prompts, inspect that plugin’s directory ownership rather than assuming the whole installation is configured identically.
Inspect wp-config.php for the authoritative override
Open the site’s wp-config.php using your host’s file manager, an encrypted file-transfer client, or an existing shell account. Search for these names:
FS_METHODFTP_HOSTFTP_USERFTP_PASSFTP_PUBKEYFTP_PRIKEYFTP_SSL
An explicit FS_METHOD forces WordPress to use the named method. When it is absent, WordPress tests the available filesystem access and follows its transport priority. The documented values are:
define( 'FS_METHOD', 'direct' );
define( 'FS_METHOD', 'ssh2' );
define( 'FS_METHOD', 'ftpext' );
define( 'FS_METHOD', 'ftpsockets' );Only one FS_METHOD definition should be active. Do not add a value merely to see what happens: the WordPress administration handbook advises defining as few upgrade constants as necessary and generally changing FS_METHOD only while troubleshooting. A forced method can make a working automatic choice fail, or can send credentials over a less secure path than the host supports.
Also check whether connection constants already contain a non-default port. The FTP_HOST value may include a port, and an SSH or FTP service can use a port different from the one used by your desktop client. Do not copy a port from another site without confirming it with the host. Passwords and private-key paths in this file are sensitive; restrict access to the file and never paste its contents into a public forum.
How to read each configuration value
| Value or setting | Meaning | Requirements and cautions |
|---|---|---|
direct |
PHP writes files directly on the server’s filesystem. | The web-server process must have suitable ownership and write permission. No network file-transfer session is involved. |
ssh2 |
WordPress uses its SSH2 PHP filesystem transport. | The built-in SSH2 upgrader requires the PECL SSH2 PHP extension. A documented SSH SFTP Updater Support plugin is an alternative when the built-in transport is unavailable. |
ftpext |
WordPress uses PHP’s FTP extension. | It can use ordinary FTP or FTPS when FTP_SSL is enabled and the server supports TLS. |
ftpsockets |
WordPress uses an FTP implementation based on PHP sockets and fsockopen(). |
It still represents an FTP transport; encryption depends on the connection mode and host support. |
FTP_SSL |
Enables FTP over TLS for the PHP FTP extension. | FTPS is encrypted FTP, not SSH File Transfer Protocol (SFTP). |
SSH2, SFTP, FTPS, and FTP: the distinctions that matter
SSH2 and SFTP
SFTP means SSH File Transfer Protocol. It runs inside an SSH connection and normally provides encryption for both credentials and transferred files. In WordPress configuration, FS_METHOD uses the value ssh2 for the SSH2 PHP transport; the label does not appear as sftp in that constant.
SSH key authentication can avoid storing an FTP password. WordPress supports the FTP_PUBKEY and FTP_PRIKEY constants for public- and private-key files. The host still has to permit SSH/SFTP access, and the PHP SSH2 extension must be available for the built-in upgrader. The private key must be readable by the PHP process but protected from other users; ask the host how it expects key files and permissions to be arranged.
FTPS
FTPS is FTP protected by TLS. In WordPress, FTP_SSL enables this mode for the FTP extension. It is encrypted, but it uses FTP’s control and data-channel model rather than SSH. The host may require a particular TLS mode or passive-transfer setting, so the account can work in a desktop client while still failing from WordPress if the server-side PHP extension is configured differently.
Plain FTP
Plain FTP does not encrypt the username, password, or file contents. WordPress administration guidance recommends SFTP or FTPS instead whenever the host supports either option. Avoid testing plain FTP on an untrusted network, and do not assume that an FTP login screen means the connection is encrypted.
| Transport | Encryption | Typical authentication | What must be available |
|---|---|---|---|
| Direct | No network transfer; protection depends on local server permissions. | Web-server process identity. | Correct file ownership and write permissions. |
SSH/SFTP (ssh2) |
SSH encryption. | Password or SSH keys. | Host SSH service and the PECL SSH2 PHP extension for the built-in updater. |
FTPS (ftpext with FTP_SSL) |
TLS encryption. | FTP username and password, subject to host policy. | PHP FTP extension and an FTPS-capable server. |
FTP (ftpext or ftpsockets without TLS) |
None; credentials and files are sent in clear text. | FTP username and password. | FTP service and the relevant PHP support. |
For comparison, encryption is only one decision factor. You also need to compare host support, PHP extensions, authentication options, file ownership, and whether you are running an automatic update or moving many files manually. A protocol that works for a human-operated client is not automatically available to the PHP runtime that performs a dashboard update.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Why WordPress asks for FTP credentials
The usual cause is a mismatch between the account that owns the WordPress files and the account under which PHP or the web server runs. WordPress’s Site Health implementation describes this condition as updates being performed over FTP because of file ownership.
Permissions can also prevent a write even when ownership appears correct. A host may use separate users, groups, restrictive directory modes, security modules, or a deployment process that replaces files with a different owner. These details are server-specific, so changing a WordPress constant is not a substitute for correcting the underlying ownership model.
Some hosts intentionally prevent PHP from writing directly and require a transfer service for administrative updates. Others configure a shared group so direct writes work. The correct solution depends on the hosting plan’s security model; changing ownership yourself can break scheduled jobs, deployments, or other sites on the account.
If the prompt appears unexpectedly
- Stop and keep the backup you made before testing.
- Check Site Health to confirm that credentials are required because of the filesystem check.
- Inspect
FS_METHODfor an old forced value that no longer matches the server. - Ask the host to verify the owner and group of the WordPress directory, the PHP process identity, directory and file write permissions, and whether direct updates are intended on that plan.
- Use the host’s supported encrypted protocol if an alternate transport is necessary.
If an update fails after choosing SSH2
Ask whether the PECL SSH2 extension is enabled for the PHP version used by the web request. A command-line PHP installation can have different extensions from the PHP handler serving WordPress, so confirmation must cover the web runtime. Also verify the SSH account, key permissions, accepted authentication method, host, and port.
If the built-in transport cannot be enabled, ask whether the documented SSH SFTP Updater Support plugin is appropriate for the site. Do not install an arbitrary updater plugin solely to bypass a prompt; confirm that it is compatible with the host and the WordPress version, and keep a backup first.
If an update fails over FTP
Confirm the FTP host, username, password, port, root directory, and whether the account can write the WordPress directories. If the host offers TLS, use FTPS rather than unencrypted FTP and make sure FTP_SSL is being applied to the PHP FTP extension. A successful login alone is insufficient if the account is restricted to a directory that does not contain the WordPress installation.
Ask whether the server requires passive mode, a firewall exception, or a specific TLS setting. These are host-side details that WordPress cannot reliably diagnose from the credentials form. Never put a private SSH key or reusable production password in an ordinary support ticket.
What to ask your hosting provider
When the exact negotiated method is not visible in WordPress, send the host a focused checklist:
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitches- Is this installation expected to update with direct filesystem writes, SFTP/SSH, FTPS, or plain FTP?
- Which protocol, port, hostname, and remote directory should WordPress use?
- What user and group own the WordPress files, and which user runs PHP?
- Are the required directories writable by that PHP user?
- Is the PECL SSH2 extension enabled for the web PHP runtime?
- Does the account support SSH public-key authentication, and where should the public key be installed?
- Does the FTP service require TLS, and is passive mode or another firewall setting required?
- Are there deployment, malware-scanning, or security tools that reset file ownership after an update?
These answers identify the server-side facts that WordPress cannot reliably infer from the dashboard alone. Do not paste a private key or password into a support ticket unless the host provides a secure credential-exchange process. Request a secure portal or temporary credentials if support must test the connection.
Automatic updates versus manual file transfers
The filesystem method used by an automatic update is not a recommendation to use the same protocol for every file operation. For a manual replacement of many core files, the WordPress administration handbook recommends an FTP, FTPS, or SFTP client. Choose encrypted SFTP or FTPS instead of plain FTP whenever available, especially on an untrusted network.
Rank #4
Manual copying also requires care with the destination directory, ownership, permissions, and partial transfers. Uploading files to the account’s home directory instead of the WordPress document root will not repair an installation, even if the transfer reports success. After a manual replacement, sign in to the dashboard, review Site Health, and check that the expected WordPress version and plugins load normally.
Never overwrite wp-config.php or the wp-content directory blindly when following a core-file replacement procedure; preserve site-specific configuration and content. Keep the backup until the site has been tested and the update has remained stable.
A compact decision checklist
- No prompt: direct writes worked for that update attempt.
- Prompt: direct writes were unavailable; identify the alternate transport before entering credentials.
FS_METHODpresent: treat its value as an explicit override and verify that the server supports it.FS_METHODabsent: WordPress is free to test the filesystem and select an available method.ssh2: verify the web PHP SSH2 extension or the documented updater-support alternative.ftpextorftpsockets: determine whether the session is plain FTP or protected with TLS.FTP_SSL: this means FTPS for the FTP extension, not SFTP.- Security concern: replace plain FTP with SFTP or FTPS when the host supports it.
- Unclear result: ask the host for protocol, port, authentication, ownership, permissions, and PHP-extension details.
Frequently misunderstood details
Does a successful update prove that WordPress always uses direct access?
No. The result applies to that operation and the files it touched. Different directories, plugins, deployment tools, or ownership changes can produce a different result later.
Can I force direct to stop the credential prompt?
You can define the value, but forcing it is safe only when the PHP process genuinely owns or can write the files. Otherwise the update will fail, and repeatedly changing the constant can obscure the real ownership problem. Verify the server configuration with the host first.
Is an SSH username and password the same as an FTP login?
Not necessarily. Hosts can use separate accounts, permissions, ports, shells, and authentication policies for SSH/SFTP and FTP/FTPS. Use the credentials and connection details issued for the selected service.
Why does Site Health mention FTP when I want SFTP?
The Site Health wording reports that update credentials are required and describes the common ownership-triggered FTP prompt. It is not a complete protocol negotiation log; inspect FS_METHOD and confirm the actual service with the host.
Recommended Free Tools
Is SFTP just FTP with encryption?
No. SFTP is a file-transfer protocol carried by SSH. FTPS is the FTP protocol protected by TLS. They use different server services, ports, authentication policies, and PHP support. A host offering one does not necessarily offer the other.
Why does FS_METHOD say ssh2 instead of sftp?
ssh2 is WordPress’s documented name for its SSH2 PHP filesystem transport. That transport can provide SFTP-style file access, but the configuration constant uses the implementation label ssh2.
Best Value
Can I omit FTP_PASS when using SSH keys?
SSH public-key authentication can avoid an FTP password. WordPress provides FTP_PUBKEY and FTP_PRIKEY for the key files, but the host must allow key authentication and the PHP SSH2 transport must be available. Confirm the required paths and permissions with the host.
Why does a desktop SFTP client work while WordPress still fails?
The desktop client and the web request may use different accounts, ports, keys, or software environments. WordPress’s built-in SSH2 updater depends on the PECL SSH2 extension in the web PHP runtime. Ask the host to compare the web runtime, account permissions, remote directory, and authentication method rather than comparing only the visible login details.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Should I leave a forced FS_METHOD value in place permanently?
Only if the host specifically requires it and the selected transport is supported. WordPress recommends defining as few upgrade constants as necessary and generally changing FS_METHOD while troubleshooting. Remove an obsolete override after the underlying ownership or server configuration has been corrected, following the host’s instructions.
Frequently Asked Questions
How do I know whether WordPress is using SSH or FTP for updates?
Run an update from Dashboard > Updates, check Site Health, and inspect FS_METHOD in wp-config.php. The value ssh2 indicates the SSH2 transport; ftpext or ftpsockets indicate FTP implementations. FTP_SSL means FTPS, not SFTP.
Why is WordPress asking for FTP credentials when I click Update?
Direct PHP writes are unavailable, usually because the web-server/PHP user does not own or cannot write the WordPress files. Site Health reports this ownership condition. Ask the host to verify ownership, permissions, and the intended update method.
Is SFTP the same as SSH2 in WordPress?
SFTP is SSH File Transfer Protocol, while ssh2 is WordPress’s configuration label for its SSH2 PHP transport. Both rely on SSH, but SFTP and FTPS are different protocols.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Can I force direct filesystem updates?
You can define FS_METHOD as direct, but do so only when the PHP process has the required ownership and write permissions. Otherwise updates will fail; correcting the server’s ownership model is safer.
What should I ask my hosting provider?
Ask for the supported protocol, hostname, port, remote directory, account and authentication method, file owner and group, PHP process identity, directory permissions, and whether the web PHP runtime has the PECL SSH2 extension.
The Bottom Line
Use the update result as the first clue, Site Health as confirmation, and FS_METHOD in wp-config.php as the configuration check. No prompt generally means direct writes worked for that operation; a prompt means an alternate transport is required. Prefer SFTP or FTPS over plain FTP, and involve the host when ownership, ports, credentials, or PHP extensions are unclear.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
