What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
When WordPress asks for FTP credentials during a plugin, theme, or core update, PHP usually cannot write to the installation directly. Start by testing the direct filesystem method, then correct file ownership or configure a supported FTP or SSH transport if the web server still cannot write. The setting changes how WordPress connects; it does not grant permissions.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
What the FTP prompt means
WordPress normally updates itself, plugins, and themes by having PHP write files inside the WordPress directory. This is called the direct filesystem method. If PHP cannot create, replace, or delete the required files, WordPress looks for another transport and displays a request for FTP credentials.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →The prompt is therefore usually a file-access problem, not proof that your FTP account is invalid. It can occur on shared hosting, managed hosting, or a self-managed virtual server. The same underlying issue also appears as “Can’t install WordPress themes – FTP error” or as an update that repeatedly asks for an FTP username and password.
- Direct access: PHP uses its own file I/O functions.
- SSH2: WordPress connects through the SSH PHP extension.
- FTP extension: WordPress uses PHP’s FTP extension.
- FTP sockets: WordPress uses PHP’s sockets class rather than the FTP extension.
WordPress attempts those methods in that order: Direct, SSH2, FTP PHP Extension, then FTP Sockets. The selection is controlled by the FS_METHOD constant in wp-config.php.
Before changing anything
- Make a backup. Download a copy of
wp-config.phpand, if possible, take a hosting backup or snapshot. The file contains database settings and may contain credentials. - Use a safe editor. Edit the file through your host’s file manager, SFTP/SSH editor, or a local copy uploaded back to the server. Do not paste PHP settings into the WordPress dashboard.
- Locate the correct installation. A server can contain several WordPress sites. The relevant
wp-config.phpis the one in the directory containingwp-admin,wp-includes, andwp-content. - Keep a recovery route. Confirm that you can restore the original file or ask the host to do so before testing constants.
First test: force the direct filesystem method
For most sites, direct mode is the simplest and safest first diagnostic. Open wp-config.php and add this line above the comment that says WordPress editing should stop (the comment normally contains “That’s all, stop editing”). Keep the spelling and quotation marks exactly as shown:
define( 'FS_METHOD', 'direct' );Save the file, return to the failed plugin, theme, or core update, and try the operation once. This setting does not create a user, change ownership, or make a read-only directory writable. It only tells WordPress to try PHP’s direct file access first.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsIf the update works, leave the setting only if your host’s configuration supports it reliably and securely. The WordPress Developer Resources guidance says to remove or revert an FS_METHOD change when it does not help. If direct mode fails, continuing to switch values at random can hide the actual ownership problem.
When direct mode still fails: check ownership and write access
A web process can write only where the operating system permits its user or group to write. On many servers, files were uploaded by a different account, restored from a backup with the wrong owner, or created by a command-line user. WordPress then runs as the web-server account and cannot replace them.
Signs of an ownership problem
- Direct mode produces the same FTP prompt or an “Unable to connect to the filesystem” message.
- Some directories update successfully while one plugin or theme directory fails.
- A newly created file is owned by a different server user than the rest of the site.
- The host’s file manager lets you edit a file, but WordPress cannot update it through PHP.
What to ask your host to verify
- Which operating-system user and group run PHP for this site.
- Whether that user can write to the WordPress root,
wp-content, plugin, theme, and upgrade directories. - Whether a security policy, immutable attribute, read-only mount, or disk quota blocks writes.
- Whether the site uses a container, chroot, or separate PHP pool with a different filesystem view.
If you do not have shell access, request an ownership and write-access reset from the hosting provider rather than applying broad permissions yourself. Do not make the whole installation world-writable: that can let unrelated processes modify PHP files and turns a maintenance problem into a security vulnerability. Specific permission values vary by host and deployment model, so use the host’s documented baseline.
Configure FTP when PHP cannot write directly
If the host requires FTP, add the connection constants to wp-config.php above the stop-editing comment. Replace the example values with the account supplied by your host:
Recommended Free Tools
define( 'FS_METHOD', 'ftpext' );
define( 'FTP_HOST', 'ftp.example.com' );
define( 'FTP_USER', 'your-ftp-user' );
define( 'FTP_PASS', 'your-ftp-password' );FTP_USER is the FTP or SSH username. FTP_PASS is its password. FTP_HOST accepts a hostname and, when necessary, a port. The default FTP port is 21; SSH normally uses port 22.
Some hosting configurations return a 503 error when the server connects to its public hostname from inside the same machine. In that situation the host may instruct you to use localhost as FTP_HOST instead. Do not substitute localhost without confirming that the FTP service is actually local to the web server.
Test the account outside WordPress
- Use an FTP client or your host’s connection test with the same hostname, port, username, password, and encryption mode.
- Confirm that the account is jailed to the directory containing this WordPress installation, or note the directory it opens in.
- Verify that you can list directories and create, rename, and delete a harmless test file in the target location.
- Remove the test file, then retry the WordPress update.
An FTP login can succeed while WordPress still fails if the account opens in the wrong directory or lacks write access to the installation. Conversely, a failed external login indicates a host, port, account, firewall, or protocol problem that WordPress cannot solve.
Use SSH2 instead of an FTP password
SSH transport is appropriate when the host provides SSH access and the PHP SSH2 extension is installed. Configure the method and key paths as follows:
Rank #3
define( 'FS_METHOD', 'ssh2' );
define( 'FTP_USER', 'your-ssh-user' );
define( 'FTP_PUBKEY', '/full/path/to/id_rsa.pub' );
define( 'FTP_PRIKEY', '/full/path/to/id_rsa' );The public- and private-key constants require full server paths. When public-key authentication is accepted, FTP_PASS can be omitted. If the private key itself is encrypted and the integration cannot prompt for its passphrase, the host may need to configure an agent or provide a key method it supports.
SSH2 will not work merely because command-line SSH works for you. The PHP process needs the SSH2 extension, permission to read the key files, and network access to the SSH service. Ask the host to confirm all three before choosing this method.
Try the FTP-sockets fallback when the FTP extension is broken
The ftpext method depends on PHP’s FTP extension. If that extension is missing or malfunctioning, WordPress documentation identifies FTP sockets as a known alternative:
define( 'FS_METHOD', 'ftpsockets' );
define( 'FTP_HOST', 'ftp.example.com' );
define( 'FTP_USER', 'your-ftp-user' );
define( 'FTP_PASS', 'your-ftp-password' );FTP sockets uses PHP’s sockets class rather than the FTP extension. It still needs a reachable FTP service and valid credentials; it does not bypass an incorrect path, blocked port, or insufficient account permissions.
Understand the available filesystem methods
| Method | What it needs | Best diagnostic use | Main caution |
|---|---|---|---|
direct |
PHP file access; no FTP or SSH extension | First test when WordPress cannot write files | Can be risky on poorly configured hosts because PHP writes directly as the web user |
ssh2 |
SSH2 PHP extension, SSH account, and usually key paths | Hosts that standardize on SSH and key authentication | Fails if the extension, keys, or SSH permissions are unavailable |
ftpext |
PHP FTP extension plus FTP host and credentials | Normal FTP-enabled hosting | Depends on the FTP extension and correct account root |
ftpsockets |
PHP sockets class plus FTP host and credentials | When the FTP extension is broken | Still requires a functioning FTP service and writable destination |
Do not confuse encrypted FTP with SFTP. The constant FTP_SSL enables encrypted plain FTP (FTPS); it does not select SFTP. SFTP is an SSH subsystem and belongs with an SSH-based configuration.
Set encryption and connection details correctly
When your host explicitly provides FTPS, you can enable encrypted plain FTP with:
define( 'FTP_SSL', true );Use the host’s stated hostname and port. An FTP service commonly listens on port 21, while SSH commonly listens on port 22, but a provider may assign custom ports. A port mismatch can look like a bad password because the connection never reaches the authentication service.
Keep credentials out of screenshots, support tickets, and version-control repositories. Because wp-config.php contains database secrets as well as filesystem credentials, restrict access to the file according to your host’s security guidance and remove credentials that are no longer needed.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteCorrect the path for symlinked or nonstandard installations
Most installations need only the base connection details. Symlinked deployments, separate content directories, and unusual document roots may also require path constants:
define( 'FTP_BASE', '/full/path/to/wordpress/' );
define( 'FTP_CONTENT_DIR', '/full/path/to/wp-content/' );
define( 'FTP_PLUGIN_DIR', '/full/path/to/wp-content/plugins/' );FTP_BASE identifies the WordPress root (the ABSPATH location). FTP_CONTENT_DIR and FTP_PLUGIN_DIR identify content and plugin paths when they do not match the standard layout. Defining the base is often sufficient; add the more specific paths only when the host’s directory layout requires them.
A successful login followed by “file not found” or an update that writes into the wrong site usually indicates a path mismatch. Compare the directory shown by your FTP client with the absolute paths used by the web server, not merely with the URL in the browser.
Diagnose common connection failures
“Unable to connect to the filesystem”
Check the selected method, host, port, credentials, and destination path. Then verify that the account can write a test file in the exact directory. If all connection details are correct, ask the host to inspect PHP extension availability and server logs.
Repeated password prompts
WordPress may be receiving a valid login but losing the connection, opening in the wrong directory, or rejecting a protocol mismatch. Re-enter the credentials in an external client, confirm whether the service expects FTP, FTPS, or SSH, and check that the account is permitted to access the WordPress path.
Updates fail only for one plugin or theme
Compare ownership and write access for the failing directory with a directory that updates successfully. A package can also contain files that are locked by a deployment process or security policy. Correct the specific directory rather than changing the entire site to broad write permissions.
Updates fail after setting FS_METHOD to direct
Direct mode cannot overcome an ownership mismatch, read-only filesystem, quota, or missing directory. Restore the previous setting if it provides no benefit, then resolve the server-side restriction or use the transport your host supports.
HTTP 503 appears during an update
Some configurations cannot reach the site’s public FTP hostname from the same server. Ask whether FTP_HOST should be localhost, whether a custom port is required, and whether the FTP service accepts local connections.
A practical decision path
- Start with direct mode. Add
FS_METHODset todirect, test one update, and remove it if it changes nothing. - Check write access. Have the host verify PHP’s operating-system user, ownership, quotas, and the target directory.
- Choose the host’s supported transport. Use SSH2 for an SSH/key-based setup,
ftpextfor a working PHP FTP extension, orftpsocketswhen that extension is unavailable or broken. - Validate connection details independently. Confirm protocol, hostname, port, account root, and the ability to create and remove a test file.
- Handle nonstandard paths. Add
FTP_BASEor the content/plugin path constants only for symlinked or relocated directories. - Retest and clean up. Complete one plugin or theme update, inspect the result, and remove temporary constants or credentials that are not required for ongoing operation.
Keep the configuration secure
- Use encrypted transport when the host offers FTPS or SSH, especially across untrusted networks.
- Prefer SSH keys over a reusable FTP password when the host supports SSH2 and key authentication.
- Never set the entire WordPress tree to unrestricted write access as a shortcut.
- Do not commit
wp-config.phpto a public repository or paste it into a forum. - Change an exposed FTP or SSH password immediately and revoke an exposed private key.
- After troubleshooting, remove obsolete
FTP_PASS, key-path, and method constants if the site can operate with direct access.
Why changing FS_METHOD is a diagnostic, not a universal fix
FS_METHOD selects the transport WordPress attempts; it does not repair ownership, alter operating-system permissions, install PHP extensions, open firewall ports, or correct an FTP account’s home directory. That is why two sites with the same WordPress version can require different solutions. One may work immediately with direct mode, another may need an ownership reset, and a third may need SSH or FTP credentials.
The reliable fix is the combination of a transport that the server supports and a destination that the corresponding account can write. Once an update succeeds, keep the smallest, least exposed configuration that remains dependable for your hosting environment.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
