Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →FS_METHOD tells WordPress which filesystem transport to use when it reads, writes, changes, or deletes files. It matters most during automatic WordPress core, plugin, theme, and language updates. WordPress normally chooses a suitable method itself, so you should force a value only when a specific permissions or update problem requires it.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
What FS_METHOD controls
WordPress uses its Filesystem API rather than assuming that PHP can always edit files directly. The API handles operations such as downloading an update package, unpacking it, replacing old files, creating directories, changing file contents, and deleting obsolete files. The same mechanism is used for core updates and for many plugin, theme, and language updates.
As an Amazon Associate I earn from qualifying purchases.
The FS_METHOD constant is an override for the transport selected by that API. Its documented values are direct, ssh2, ftpext, and ftpsockets. The value does not identify a plugin or an update channel; it identifies how the PHP process reaches the WordPress filesystem.
For most installations, leaving the constant undefined is the right starting point. WordPress tests the server and selects a method that appears usable. Hard-coding a method can hide the real ownership or permission problem, and a transport that works on one host may fail on another.
How WordPress selects a filesystem method
The get_filesystem_method() function determines the transport used for filesystem operations. Its documented preference order is:
- Direct PHP file access.
- SSH2.
- PHP FTP extension.
- FTP sockets, using the sockets class or functions such as
fsockopen().
That order is a preference, not a guarantee that every method will be available. WordPress checks the server context, whether the PHP process can write the target files, and which PHP extensions or socket functions are present. A defined FS_METHOD constant overrides the normal result. Code can also alter the result with the filesystem_method filter, so a plugin, host configuration, or custom deployment code may affect the final choice.
Automatic selection generally avoids asking for remote credentials when the web-server/PHP account already owns the files and has the required write access. If those conditions are not met, WordPress may choose a remote transport and ask for credentials instead.
The four valid FS_METHOD values
| Value | How it works | What the server must provide | Typical reason to use it |
|---|---|---|---|
direct |
PHP opens and changes files through the local filesystem. | The PHP process must be able to write the WordPress files with compatible ownership and permissions. | Use when the hosting account running PHP safely owns the installation and direct writes work. |
ssh2 |
WordPress uses the SSH2 transport to reach the filesystem. | An available SSH2 PHP extension and valid SSH connection details; keys and connection data may be supplied through the related FTP_* constants. |
Use when the host provides SSH-based file access and direct ownership cannot be aligned. |
ftpext |
WordPress uses PHP’s FTP extension. | The PHP FTP extension, plus an FTP account that can reach and modify the installation. | Use when the host supports ordinary FTP through the PHP extension. |
ftpsockets |
WordPress uses socket-based FTP access through the sockets class or functions such as fsockopen(). |
Working socket support and an FTP service that accepts the supplied credentials. | Use as a fallback when the normal PHP FTP extension is unavailable or incompatible. |
These names are exact and case-sensitive in configuration examples. A value outside this list is not a supported filesystem method.
Why WordPress asks for FTP credentials
An FTP prompt usually means the PHP process handling the dashboard does not appear to own, or cannot write, the files that an update must change. This is common when files were uploaded by one system account but PHP runs as another account. It can also occur when a directory is writable for an administrator’s shell account but not for the web-server account.
The Filesystem API detects this situation while testing whether it can create or modify files. Rather than silently failing, WordPress offers a remote transport so it can authenticate as an account that has the necessary access. The prompt is therefore a symptom of the server’s ownership, permissions, available PHP libraries, or transport configuration; it is not proof that WordPress itself is damaged.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The exact prompt depends on the method that is available. FTP credentials are for an FTP transport. SSH credentials or keys are for the SSH2 transport. Supplying an FTP password to an SSH endpoint, or an SSH key to an FTP endpoint, will not make the protocols interchangeable.
Should you set define( 'FS_METHOD', 'direct' );?
Set direct only when you have established that the PHP process can safely write the WordPress directories. If direct access already works, there is usually no benefit to adding the constant: automatic detection will select it. If direct access fails because ownership is wrong, forcing direct does not repair ownership and may turn a clear credential prompt into failed updates.
Rank #3
WordPress documentation warns that direct access can expose security problems on a poorly configured host. The important question is not simply whether a directory is writable, but whether it is writable by the intended PHP account and protected from unintended users or processes. Correcting ownership and permissions at the hosting level is generally safer than making a broad write rule and then forcing direct access.
- Leave it undefined when updates work and WordPress automatically selects a method.
- Use
directwhen the PHP account owns the files and direct updates have been verified. - Use
ssh2,ftpext, orftpsocketsonly when that protocol is actually enabled by the host and its account can modify the installation. - Remove the override if forcing a method does not solve the observed problem.
How to add or remove the constant
Make a backup of wp-config.php before editing it. A syntax error in this file can prevent WordPress from loading.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Open the
wp-config.phpfile in the site’s document root using the host’s file manager, an SSH session, or another authenticated administration method. - Find the existing
FS_METHODdefinition. Keep only one active definition; duplicate constants make troubleshooting confusing and the first definition may be the one that takes effect. - To force direct access, add this line before the comment that says WordPress’s editing section should end, or at another location where your host’s configuration conventions permit constants:
define( 'FS_METHOD', 'direct' );- For another supported transport, replace
directwith exactlyssh2,ftpext, orftpsockets. Configure the required connection details through a secure process rather than placing credentials where other users can read them. - Save the file and run the update or filesystem operation that previously failed. Check both the result and the site’s error log.
- If the override does not help, delete or comment out the line and return to automatic detection before investigating ownership, permissions, extensions, or host-side restrictions.
Do not paste a second define() line simply because a tutorial uses a different value. Change the existing setting or remove it, then test one change at a time.
FTP, FTPS, SSH, and SFTP are not the same setting
The method names describe different transports. ftpext and ftpsockets use FTP; the former relies on PHP’s FTP extension and the latter uses socket support. ssh2 uses the SSH2 PHP transport. The FTP_SSL configuration option documented by WordPress refers to secure FTP support for the underlying FTP transport; it does not convert FTP into SSH or SFTP.
Ask the host which protocol, port, PHP extension, and authentication method it supports before choosing a value. A host may offer SFTP in its control panel while not providing the SSH2 PHP extension to the web process, or it may offer FTP access while the PHP FTP extension is disabled. Those details determine whether a forced method can work.
A practical decision process
When updates already work
Do not add FS_METHOD just because you saw the constant in a configuration guide. Automatic selection is already doing the required job, and leaving the file unchanged avoids locking the site to a transport that could become unavailable after a hosting change.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →When WordPress asks for credentials
First determine whether the web-server/PHP account owns the WordPress files and whether the required directories are writable by that account. If the host can correct ownership safely, that is usually preferable to forcing a remote method. If ownership cannot be aligned, ask which of SSH2, the PHP FTP extension, or socket-based FTP is supported and use that matching transport.
When an update fails after entering credentials
Confirm that the credentials belong to the same protocol as the selected method and that the account has permission to modify the target directories. Check whether the corresponding PHP extension or socket functions are enabled. A valid account cannot compensate for a missing PHP transport, and an enabled transport cannot compensate for an account that lacks write access.
When a forced value changes nothing
Remove the constant and retest automatic detection. Then inspect the specific error, the ownership of the files, the writable directories, and any host security policy that blocks the connection. Forcing a value is an intervention for a demonstrated filesystem problem, not a general performance or security setting.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Common failure modes and fixes
| Symptom | Likely cause | Next action |
|---|---|---|
| The dashboard repeatedly requests FTP details. | The PHP account cannot write the files directly, or no usable direct transport was detected. | Have the host verify ownership and permissions; otherwise select the remote protocol the host actually supports. |
direct is configured but updates still fail. |
Forcing a method cannot repair incorrect ownership, unwritable directories, or host restrictions. | Remove the override, correct the server-side access issue, and test automatic detection. |
ssh2 fails immediately. |
The SSH2 PHP extension is unavailable, or the supplied endpoint, account, or key is not valid. | Confirm SSH2 support with the host and verify the SSH connection details and key configuration. |
ftpext is unavailable. |
The PHP FTP extension is not installed or enabled for the PHP version serving WordPress. | Ask the host to enable it or use a supported alternative such as socket-based FTP. |
ftpsockets cannot connect. |
Socket functions are unavailable, blocked, or the FTP service does not accept the account. | Confirm socket support, the FTP service, and the account’s permissions before changing methods. |
The site shows an error after editing wp-config.php. |
A PHP syntax mistake, an incorrectly quoted value, or duplicate configuration was introduced. | Restore the backup, check punctuation and quotes, and keep one valid definition. |
Security and maintenance considerations
Filesystem access is a privilege, not merely an update convenience. A direct method gives the PHP process the ability to alter WordPress files locally, so the web account and file ownership model must be deliberate. Remote methods add credentials or keys that must be protected and rotated according to the host’s policy.
Recommended Free Tools
Use the narrowest change that resolves the problem. Do not make every file broadly writable just to avoid a prompt, and do not store a reusable password in a location readable by unrelated users or services. If a managed host controls PHP extensions and ownership, ask it to implement the correction centrally rather than repeatedly editing wp-config.php.
After a hosting migration, PHP version change, or permission change, retest updates. A previously correct forced method can become invalid when an extension is disabled or when the account running PHP changes. Removing an obsolete override lets WordPress reassess the current environment.
Quick Recap
What to remember
FS_METHODcontrols how WordPress performs Filesystem API operations, especially automatic updates.- The supported values are
direct,ssh2,ftpext, andftpsockets. - WordPress normally prefers direct access, then SSH2, the PHP FTP extension, and FTP sockets.
- An FTP prompt commonly indicates a mismatch between file ownership or permissions and the PHP account, or a limitation in the available transport.
- Use a forced value only for a specific, verified problem, and remove it if it does not fix that problem.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
