WordPress asks for FTP credentials when its filesystem update path needs a connection instead of writing directly. That prompt is not asking for your WordPress administrator password. Confirm the host's supported update method before entering credentials or forcing direct access.
An unexpected prompt after a migration deserves investigation. On some hosts it reflects an ownership mismatch. On others, application code is deliberately read-only and updates belong in a deployment process. The same screen can therefore require different fixes.
Establish which operation triggered the prompt
Record whether the prompt appeared while installing a plugin, updating a theme, or changing core files. Note the affected environment and the last successful update. If only one component fails, compare its directory ownership with a working component instead of treating the entire installation as broken.
Ask the host whether browser-based updates are supported for this site. A managed deployment can intentionally prevent PHP from modifying code. In that arrangement, adding write access may undo an important control without fixing the release workflow.
Separate login credentials from filesystem access
The filesystem credential API supports connection details used by the selected filesystem transport. A dashboard account does not automatically provide those details. Obtain the hostname, account, allowed directory and supported encrypted transport through the host's authenticated channel.
Do not paste a hosting master password into an unfamiliar plugin prompt. Confirm that the page is your own authenticated WordPress administration screen. Do not assume FTP, FTPS and SFTP are interchangeable: the available method depends on the server and installed support.
Unexpected prompt: Compare with the last successful update. One plugin only: Inspect that directory before wider changes. Managed deployment: Ask whether code is intentionally read-only. Safe completion: Verify version, ownership and update repeatability. Original explanatory guide, not a customer test result.
Check ownership before applying a shortcut
WordPress's filesystem-method selection considers configuration and its ability to write with suitable ownership. A developer can inspect the chosen method and the relevant configuration without printing secrets.
The host should compare the application worker identity, target directory owner, and intended deployment account. Use our post-migration permission guide for that boundary. A successful write by your SSH account does not prove PHP can safely perform the same operation.
Avoid a blanket permission change or an unconditional FS_METHOD direct setting. Neither establishes that the worker should own those files. Also check whether a container recreates permissions at deployment, otherwise a manual change may disappear on the next release.
Perform one controlled update
Choose a maintenance window and preserve a recoverable backup. On staging, update one low-risk component using the host-approved method. Check its installed version, file owner, frontend behavior, and a second update check. Remove any temporary connection details from insecure notes or support tickets.
If the prompt persists, collect the failing operation, selected transport, sanitized error, affected path, and host policy. Do not attach passwords. Request update troubleshooting when responsibility is split between deployment tooling and the hosting account.
Success is a repeatable authorized update, not merely making the prompt disappear. Document who owns future updates and which channel they must use so the next operator does not recreate the same permissions problem.
Sources checked October 1, 2026. Instructions and visuals are explanatory, not claims of customer tests.