When I initially set up WP, I had entered my FTP details in the Admin so that I could add plugins and themes directly from Admin. However, I believe this compromises the website as I have found malware in the plugins and themes folders on many occasions.

Please can someone advise me on how I can revoke WPs FTP access? I don't want WP to be in control of adding plugins and themes and would rather do this via my FTP client.


  • WordPress only has FTP access if you grant it. Just don't grant it. – Dan Mar 27 '14 at 17:45
  • Well, that is exactly the dilemma I am facing. I have changed the FTP password, but WP still seems to be able to access and add plugins and themes – user1038814 Mar 27 '14 at 17:56

You can simply delete the lines from your wp-config.php.

define('FTP_HOST', 'yourhost.com');
define('FTP_USER', 'youruser');
define('FTP_PASS', 'yourpass');

However, this does not automatically mean that you are secure. There are a lot of backdoors where malware could be injected, starting from the server, security-issues in your plugins, outdated software etc.

Please be sure to check for all the latest versions.

Also, if you have set your file permissions to FTP-only, you will not be able to upload media or update plugins/WordPress if you do not change them.

  • Unfortunately, I can't find these lines in my wp-config file. Baffling! – user1038814 Mar 27 '14 at 17:42
  • Are you sure WP is using FTP..? Unless WP doesn't have write access to the WP install directory, it will generally not use FTP, but rather directly download files and save to disk. – Dan Mar 27 '14 at 18:41
  • Is there any way to prevent that behaviour? – user1038814 Mar 27 '14 at 19:21
  • Don't give permission to add themes/plugins to any user other than the primary admin. – Dan Mar 28 '14 at 3:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.