TECH / Servers & Websites October 30, 2019 3 min read

“WordPress Requires FTP Credentials to Update”: How to Update Without FTP

Antonio NEMCD Author

Published Oct 30, 2019 · 3 min

I opened WordPress’s Site Health section and got this reproach: “Your WordPress install requires FTP credentials to perform updates”.

WordPress

It made me uneasy: it doesn’t seem to get in the way, but I decided to figure it out.

The old-school way, I used to update over FTP, then over secure FTPS. It was time to move on and update without FTP at all. It’s quite easy, but I decided to write about it because there’s wrong information going around about what code to add and where.

Why WordPress asks for FTP

WordPress writes files directly only if PHP can write to the site folder and the files belong to the same user PHP runs as. If not, it falls back to FTP and asks for a login and password.

How to update without FTP

Open wp-config.php in the site root and, before the line “That’s all, stop editing!”, add:

define( 'FS_METHOD', 'direct' );
define( 'FS_CHMOD_DIR', 0751 );
define( 'FS_CHMOD_FILE', 0644 );

FS_METHOD tells WordPress to write files directly, while FS_CHMOD_DIR and FS_CHMOD_FILE set permissions for the folders and files it creates. If updates still fail after that, check that the site files belong to the user PHP runs as.

Why not the code from the internet

Some guides suggest adding add_filter('filesystem_method', create_function(...)) to wp-config.php. Don’t:

add_filter isn’t loaded yet in wp-config.php, so the site crashes with a 500 error;
in a theme’s functions.php that code works, but create_function has been deprecated since PHP 7.2 and throws warnings.

The FS_METHOD constant in wp-config.php is WordPress’s standard way: it’s simpler and doesn’t depend on the theme.

Which permissions to set

0751 for folders means read, write and execute for the owner, read and execute for the group (no write), and execute only for everyone else (no read or write). These permissions don’t always fit: it depends on how the server and users are set up.

I, for example, use 0770: full access for the owner and their group, and no permissions for anyone else.

Better not to use 0777: then anyone on the server can write to your site’s folders.

A small addition, and the blog’s health is at 100%!

Site Health at 100%