Recommended Free Tools
If WordPress accepts the same FTP password for other installations but asks for credentials on one site, the password is rarely the whole problem. The failing site usually has a different document root, FTP/SFTP jail, file owner, group, PHP user, or filesystem method. First verify the host, port, protocol, account, and remote path. Then compare ownership and permissions with a working site before changing FS_METHOD.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
WordPress asks for filesystem credentials when its direct write test fails. A successful login in an FTP client proves that the account can connect; it does not prove that the PHP process running this particular site can write its files.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsWhat the one-site symptom tells you
When several WordPress sites share a server and only one displays an FTP-credentials prompt, investigate differences between the sites rather than immediately resetting a password. WordPress’s Filesystem API selects a transport that can modify files. If direct writes are unavailable, it requests credentials for another transport. See the WordPress Filesystem API documentation.
A site can fail while the account details are valid because:
- The affected site uses a different hostname, port, protocol, or FTP/SFTP account.
- The account logs in successfully but starts in the wrong directory, so WordPress cannot find
wp-content. - PHP-FPM or the web server runs as a user that does not own the site’s files or lack group-write access.
- The files have restrictive modes, or directories and files are owned by different users after a migration or manual upload.
- The site’s PHP environment lacks the transport WordPress is trying to use.
FS_METHODis forcing an unsuitable method inwp-config.php.
WordPress’s permissions guidance describes a setup in which the web process has proper ownership and therefore does not ask for FTP credentials during plugin installation or updates. That is a filesystem arrangement, not a special kind of FTP password. Read the WordPress file-permission guidance.
Use this diagnostic order
- Record the exact host, port, username, protocol, and remote directory supplied by the host for the affected site.
- Test those values in an independent FTP/SFTP client.
- Confirm that the login opens at the site’s document root and that
wp-content,wp-admin, andwp-includesare present. - Compare the affected site’s owner, group, and modes with a site that updates without a prompt.
- Identify the PHP-FPM or web-server user for the failing virtual host.
- Check whether
FS_METHODis set and whether the selected transport is available. - Correct ownership, group membership, path, or host configuration. Only then retest an update.
Work on a backup or staging copy when changing ownership or configuration. Do not make an entire site world-writable just to suppress the prompt.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →1. Verify endpoint, account, and protocol
Match the host’s exact connection details
Use the provider’s values for the affected site, not the values from a neighboring installation. Check the hostname, port, username, password, and whether the service is FTP, explicit FTPS, implicit FTPS, or SFTP. WordPress exposes related constants such as FTP_HOST, FTP_PASS, and FTP_SSL in its configuration reference; they must describe the service you actually have. See the wp-config.php reference.
SFTP is not FTP with a different password. It is an SSH-based transport with its own server, port, account, and authentication rules. WordPress’s hardening guidance notes that SFTP encrypts the password and other data in transit, whereas ordinary FTP does not. Review WordPress’s hardening guidance.
Do not infer success from another site
A credential can work for one virtual host and be rejected for another if the accounts, jails, or services differ. Confirm that the username is authorized for this site’s directory and that the account is not read-only. If the host uses separate SFTP and FTP accounts, selecting the wrong protocol can produce a connection failure even when the username looks familiar.
Interpret client errors precisely
- Connection refused or timed out: investigate the hostname, port, firewall, service status, or TLS requirement.
- Authentication failed: verify the account, password, key, and whether the account is enabled for the selected protocol.
- Login succeeds but files are missing: inspect the starting directory, chroot/jail, and document root.
- Login and browsing work but uploads fail: inspect ownership, write permission, quotas, and read-only mounts.
2. Confirm the remote document root
WordPress must be operating in the directory that contains its own installation. A valid FTP login can still be useless if it opens in a parent directory, a different site’s directory, or a jailed path that does not expose the WordPress files.
What to check
- Locate
wp-config.phpand thewp-contentdirectory in the client. - Confirm that the path corresponds to the affected domain’s document root, not a sibling domain or staging folder.
- Compare the working site’s absolute server path and the failing site’s path.
- Check whether the account’s home directory is being treated as the document root by the FTP service.
If the client opens in the wrong place, do not guess a path in WordPress. Ask the host for the exact document root and the directory that the FTP/SFTP account is permitted to access. A path mismatch can make WordPress report a credentials problem even though authentication succeeded.
3. Compare ownership and the PHP execution user
FTP ownership and PHP ownership are separate checks. The FTP account may be able to upload files while PHP cannot modify them, or PHP may own the files while the FTP account cannot replace them. WordPress’s guidance says files that need to be writable should be owned, or group-owned, by the account WordPress runs as. Use the permissions handbook as the reference for your hosting model.
Find the relevant users
On a shell-managed server, inspect the owner and group of the installation and its key directories with commands such as ls -ld /path/to/site, ls -l /path/to/site/wp-content, and stat /path/to/site/wp-content. The exact path and available commands depend on the host. Identify the user running PHP-FPM or the web server for this virtual host; common shared-hosting panels expose that information in the site or PHP settings.
Compare those results with a site that can install a plugin without prompting. Differences often reveal a migration that copied files as root, an extraction performed by a deployment account, or a PHP pool assigned to the wrong user.
Rank #3
Choose an ownership model deliberately
- Single-site account: the PHP process and the site’s files use the same account. Direct writes usually work with least complexity.
- Shared group: PHP and deployment/FTP accounts share a group, and the required directories have group-write access. This can work, but group membership and default umasks must remain consistent.
- Separate service accounts: PHP and FTP accounts do not share ownership or write access. WordPress may need an SSH/FTP transport, or the host must change the ownership model.
Do not change ownership recursively without knowing how the host provisions the site. On managed or shared hosting, a manual chown can break the control panel, PHP pool, backups, or security isolation. Request the host’s approved ownership command or have support apply the change.
4. Correct permissions without using 777
WordPress’s general examples are directories 755 or 750 and files 644 or 640, with stricter treatment for wp-config.php. The correct values depend on the owner, group, and host’s execution model. The handbook specifically warns against setting directories to 777 in the described suexec-style setup. See the complete permissions guidance.
Check the write locations first
Updates and plugin/theme installations commonly need to write inside wp-content, including its plugins, themes, uploads, and upgrade directories. A directory can be writable while a file inside it is owned by another user, so inspect both directories and representative files. Also check disk quotas, inode limits, and a read-only filesystem if permissions appear correct but writes still fail.
Use least privilege
- Keep ordinary files non-executable unless the application requires otherwise.
- Grant write access to the PHP user or an approved shared group, not to every account on the server.
- Protect
wp-config.phpmore strictly than public content where the host supports it. - Never apply a blanket recursive
chmod 777as a troubleshooting shortcut.
If a host’s panel offers a “reset permissions” action, read what it changes before using it and capture the current owner/group values first.
5. Understand and verify FS_METHOD
WordPress documents four valid filesystem methods: direct, ssh2, ftpext, and ftpsockets. Its automatic transport priority is direct, SSH2, the FTP PHP extension, then FTP sockets. See get_filesystem_method().
What each method means
| Method | How WordPress writes | Typical dependency | Use when |
|---|---|---|---|
direct |
PHP writes to the local filesystem | The PHP/web-server user has the necessary ownership or group access | The server’s ownership model is correct |
ssh2 |
WordPress uses SSH/SFTP transport | SSH2 support and valid SSH credentials or keys | The host provides SSH and direct writes are intentionally unavailable |
ftpext |
WordPress uses PHP’s FTP extension | The extension is installed and enabled | The host supports this FTP transport |
ftpsockets |
WordPress uses FTP sockets | Socket access and a reachable FTP service | The other supported transports are unavailable |
Should you add FS_METHOD direct?
Only as a targeted diagnostic or configuration change after confirming that PHP should be able to write locally. In wp-config.php, a forced value is written as a PHP constant, for example define( 'FS_METHOD', 'direct' );. Place it before the line that says editing is stopped, and preserve a backup of the file.
Forcing direct can remove the prompt while leaving the underlying ownership failure. It may then cause updates to fail, create files owned by an unexpected account, or expose a security boundary that the host intentionally configured. WordPress advises changing FS_METHOD only to address update problems and reverting the change if it does not help. Fix ownership and permissions with the host whenever possible.
When a forced FTP method fails
A forced ftpext or ftpsockets method can fail because the PHP extension is disabled, sockets are restricted, TLS settings do not match, the port is blocked, or the remote path is wrong. A forced ssh2 method has its own SSH host-key, account, key/password, and path requirements. Changing the constant cannot compensate for any of those conditions.
6. Test outside WordPress
An independent FTP/SFTP client separates connection problems from WordPress’s filesystem decision. Enter the same host, port, protocol, username, and password or key that the site is supposed to use.
- Connect without saving a new password in a public or shared computer.
- Navigate to the directory that contains
wp-config.phpandwp-content. - Create a small temporary file only if the host permits it and you have a rollback plan; then delete it and verify that deletion succeeds.
- Record whether the client can list, upload, replace, and delete files in the directories WordPress needs.
If the independent login fails, correct the hosting account or service first. If it succeeds but WordPress still prompts, focus on the PHP user, WordPress’s selected filesystem method, the path WordPress detects, and PHP restrictions. An FTP client does not emulate the PHP process, so its success is evidence about the account—not proof that direct writes should work.
7. Common cases and the right fix
The password works elsewhere, but this site rejects it
Re-check the affected site’s hostname, protocol, port, and account. Shared hosting commonly assigns different jails or credentials per site. Ask support to confirm that the account is enabled for the selected service and mapped to this domain’s document root.
The client connects, but WordPress cannot find files
Correct the starting directory or jail. Verify that wp-content exists at the path WordPress uses. Do not move files until you have confirmed the host’s document-root mapping and a current backup.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The client uploads successfully, but updates still prompt
Compare the PHP execution user and owner/group of the installation. The FTP account may write while PHP cannot. Have the host align ownership or configure an approved shared group, then remove any unnecessary forced FS_METHOD value.
The prompt began after a migration or restore
Inspect files extracted by a deployment or administrative account. Restore the hosting provider’s expected owner and group, including newly created directories under wp-content. Check quotas and read-only mounts if ownership is correct.
Forcing direct makes the prompt disappear but updates fail
Undo the forced method and repair the write context. The disappearing prompt only shows that WordPress stopped asking for another transport; it does not demonstrate that the local write operation is safe or successful.
8. What to ask hosting support to compare
Escalate when you cannot inspect or change service users, ownership, jails, or PHP settings. Give support the affected domain, the exact WordPress error, the time it occurred, and a comparison site that works. Ask them to compare:
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →- The document root and absolute filesystem path.
- File owner and group for the site root,
wp-content, and a representative plugin directory. - The PHP-FPM pool or web-server user and its supplementary groups.
- The FTP/SFTP account, jail, protocol, port, and starting directory.
- Whether the PHP FTP or SSH2 extension is enabled if that transport is required.
- Disk quota, inode quota, read-only mounts, and security policies that could deny writes.
Ask the host to apply the least-privilege correction and tell you which filesystem method it expects WordPress to use. This is safer than recursively changing modes or ownership on a managed server.
Security and maintenance checks after the fix
- Remove temporary test files and credentials from notes or scripts.
- Use SFTP or another encrypted transport when the host supports it; SFTP is distinct from FTP, not merely a password option.
- Keep
wp-config.phpout of public downloads and use the host’s recommended restrictive mode. - Review any
FS_METHODconstant during future migrations so an old workaround does not mask a new ownership problem. - Retest a plugin update, a theme update, and an upload, then verify that newly created files have the expected owner and group.
A compact decision checklist
- Connection: Does the exact account connect with the exact host, port, and protocol?
- Path: Does it open at the affected site’s document root containing
wp-content? - Identity: Which user and group own the files, and which user runs PHP?
- Modes: Are directories and files using least-privilege modes such as the handbook’s general
755/750and644/640examples? - Method: Is
FS_METHODunset or intentionally set to one of the four supported values? - Write test: Can the PHP process create, replace, and remove a file where WordPress needs to write?
- Escalation: If any answer is unknown, can the host compare the failing site with a working one?
The Bottom Line
A WordPress FTP prompt on only one site usually means that site’s path, ownership, PHP user, permissions, or transport differs from the others. Verify the endpoint and document root, compare the PHP execution context and file ownership, use least-privilege permissions, and treat FS_METHOD as a diagnosed configuration—not a substitute for fixing the filesystem.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
