WordPress Asking for FTP Credentials to Update Plugins

You click Update or Install and WordPress shows a "Connection Information" box asking for FTP details. It is not a hack or a broken site — WordPress simply does not have permission to write its own files.

Common signs of this issue

• A "Connection Information" screen appears when you try to update or install a plugin, theme, or WordPress itself.
• It says: "To perform the requested action, WordPress needs to access your web server. Please enter your FTP credentials to proceed."
• It asks for a hostname, FTP username, FTP password, and connection type (FTP, FTPS, or sometimes SSH).
• It started after moving the site to a new host or server, or after someone uploaded or restored files by hand.
• Automatic background updates have quietly stopped, and plugins have been sitting at old versions for weeks.
• Uploading images may still work fine, which makes the update prompt feel random.

Safe checks you can do yourself

None of these require sharing passwords with anyone.

• Close the box and don't type anything into it yet. Nothing is broken by leaving it — your site keeps running, it just cannot update itself until the cause is fixed.
• Note exactly when it started. If it began after a move, a restore, or someone uploading files manually, that strongly points to file ownership on the server, which is a quick fix for your host.
• Go to Tools > Site Health and open the Info tab, then the Filesystem Permissions section. It lists whether the main WordPress folder, the content folder, plugins, and themes are writable. Anything marked "Not writable" confirms the cause.
• Contact your host and tell them: "WordPress asks for FTP credentials when updating plugins — can you check the file ownership and permissions for my site?" On a correctly set up account, the files are owned by the same user that runs PHP and WordPress can update directly.
• If you manage your own server or VPS, pass the same question to whoever set it up. Mismatched file ownership between the web server user and the account user is the classic cause.
• If someone suggests adding define('FS_METHOD', 'direct'); to wp-config.php, ask them to confirm the file ownership first. That line tells WordPress to skip the check, which works only when ownership is already correct, and can hide a real permissions problem.
• If your host's own advice is to enter FTP or SFTP details, use the credentials from your hosting dashboard, preferably SFTP, and only on your own site's admin screen — never in an email or a form someone sends you.

What this usually means

Before WordPress installs or updates anything, it checks whether it can create files in its own folders as the same user that owns them. If it can't, it falls back to asking you for FTP details so it can log in and write the files that way. The Connection Information box is that fallback. It is a WordPress feature, not an error message, and it has been there for many years.

On almost all modern shared and managed hosting, this check passes and the box never appears. When it does appear, the usual reason is that the site's files are owned by a different user than the one PHP runs as — often after a migration, a restore from backup, or files copied over by hand as a different user. Overly tight folder permissions are the other common cause.

This matters because a site that cannot update itself falls behind on security fixes without anyone noticing. Out-of-date plugins are one of the main ways small business WordPress sites get hacked. The right fix is to correct ownership on the server so updates work normally again, not to keep typing passwords into the box every time.

What not to do

• Don't share your FTP, SFTP, or hosting password with anyone who contacts you about this message. Ask your host directly instead.
• Don't set folders or files to 777 permissions to make the box go away. It lets anyone on the server write to your site and is a common route for hacks.
• Don't store your FTP password in wp-config.php as a permanent workaround unless your developer has a good reason and the file is properly protected.
• Don't ignore it and leave updates undone for months. A site stuck on old plugin versions is far more likely to be compromised.
• Don't try to update plugins by uploading folders over FTP yourself unless you know how to do it safely; a half-copied plugin can take the site down.
• Don't assume the site has been hacked because of this box alone. It is a normal WordPress permissions prompt.

When to get help

If your host says permissions are fine but the box keeps appearing, or you run your own server and nobody is sure who set it up, it is worth bringing in a developer. Fixing file ownership properly is usually a short job for someone with server access, and it restores automatic updates without loosening security. It is also sensible to get help if plugins have been stuck for a long time — someone can update them safely, ideally on a staging copy first, and check nothing breaks along the way.

Frequently asked questions

Related free guides