62

I'm following Changing File Permissions « WordPress Codex, yet when I'm try to update and/or install plugin and/or theme through wp-admin, I'm getting following:

To perform the requested action, WordPress needs to access your web server. Please enter your FTP credentials to proceed. If you do not remember your credentials, you should contact your web host.

from file system level:

# ls -ld wp-content/ wp-content/plugins/ wp-content/themes/
drwxrwxr-x.  6 root apache 4096 Jun  2 12:01 wp-content/
drwxrwxr-x. 28 root apache 4096 Jun  2 00:00 wp-content/plugins/
drwxrwxr-x. 11 root apache 4096 May 11 16:34 wp-content/themes/
# 

httpd runs as apache:

$ ps auxw | grep httpd
root     20158  0.0  0.1 533080 26192 ?        Ss   15:03   0:00 /usr/sbin/httpd -DFOREGROUND
apache   20233  0.0  0.2 612608 34908 ?        S    15:03   0:00 /usr/sbin/httpd -DFOREGROUND
apache   20234  0.0  0.2 538772 46904 ?        S    15:03   0:00 /usr/sbin/httpd -DFOREGROUND
apache   20235  0.0  0.1 536832 24268 ?        S    15:03   0:00 /usr/sbin/httpd -DFOREGROUND
apache   20236  0.0  0.2 626272 35640 ?        S    15:03   0:00 /usr/sbin/httpd -DFOREGROUND
apache   20237  0.0  0.0 535296  9592 ?        S    15:03   0:00 /usr/sbin/httpd -DFOREGROUND
apache   20322  0.0  0.1 537088 26620 ?        S    15:03   0:00 /usr/sbin/httpd -DFOREGROUND
apache   20380  0.0  0.2 626060 33816 ?        S    15:04   0:00 /usr/sbin/httpd -DFOREGROUND
apache   20429  0.0  0.1 538216 29184 ?        S    15:04   0:00 /usr/sbin/httpd -DFOREGROUND
apache   20447  0.0  0.2 629380 43180 ?        S    15:04   0:00 /usr/sbin/httpd -DFOREGROUND
apache   20448  0.0  0.2 626172 35224 ?        S    15:04   0:00 /usr/sbin/httpd -DFOREGROUND
alexus   24073  0.0  0.0 112652   972 pts/9    R+   15:13   0:00 grep --color=auto httpd
$ 

I'd like to be able to perform requested action (install and/or update) through /wp-admin without FTP credentials.

How can I do that?

7
  • 1
    Is this a localhost installation? If so, see: wordpress.stackexchange.com/questions/19649/… Jun 2 '16 at 17:55
  • 1
    @GregMcMullen no, this is NOT localhost installation & "accepted" answer from link that you comment is to recursively change ownership of a wordpress directory to nobody - this won't work for me due to httpd runs as apache.
    – alexus
    Jun 2 '16 at 19:32
  • @alexus It looks like your files are owned by root.apache at the moment. Did you try apache.apache instead of nobody?
    – Tim Malone
    Jun 2 '16 at 21:28
  • @TimMalone setting files/directory as apache.apache or root.apache wouldn't make any difference, as long as httpd runs as apache, and apache's uid is part of apache gid's group, it's all the same, because my permissions set to g+w.
    – alexus
    Jun 2 '16 at 21:37
  • @alexus Ok, something else to try - set FS_METHOD to 'direct' in wp-config.php (codex.wordpress.org/…)
    – Tim Malone
    Jun 2 '16 at 21:43
132

Add the following to wp-config.php:

define( 'FS_METHOD', 'direct' );

Let me know how it works for you.

6
  • 3
  • 1
    worked for me unless you have bad permissions in the file system. Btw I added it at the very top of the wp-config.php
    – Toskan
    Sep 28 '18 at 18:12
  • 1
    Make sure to read the post Alexus linked to before using this method. This method definitely works (it solved the problem for me), but you should definitely not use this method in a shared hosting environment or any at-risk environment where you could compromise security by doing this.
    – JamesHoux
    May 18 '19 at 15:51
  • 2
    after adding this I have getting this error: Update Failed: The update cannot be installed because we will be unable to copy some files. This is usually due to inconsistent file permissions.
    – Sabbir
    Mar 18 '20 at 3:57
  • 1
    dude!! you are my hero. thanks for saving hours of my time for this Feb 14 at 14:31
27

This means that WordPress is having limited permission for making changes in the folder that it was installed.

In-order to fix this, all that you need to do is provide necessary permissions for the same.

Run the following Command in your Terminal / Putty / Commandline Prompt after connecting to your Server via SSH:

sudo chown -R apache:apache /var/www/html

Checkout this article for full details.

7
  • 1
    permissions are fine, re-read my question)
    – alexus
    Aug 5 '16 at 18:55
  • 3
    chown: invalid user: ‘apache:apache’
    – numediaweb
    Feb 2 '18 at 9:46
  • 4
    Remember, Apache can be different users in different flavors of Linux. So you can try groups <username> and see if it errors out or not, since the user and group for Apache is usually the same. Then use the correct user. The most common in Ubuntu is "www-data:www-data" or "www:www" for chown-ing Apache files. Jan 25 '19 at 16:09
  • After I could find the right user name this worked just great (see also command to list all users)
    – Top-Master
    Jan 8 '20 at 11:38
  • In case you want to use it on OSX, use _www:_www (Mojave, don't know what it wolud be in other versions)
    – Larzan
    May 6 '20 at 14:08
8

Even though it is totally correct to have the ownership as root:apache with permissions 775, and httpd to run as apache, Wordpress does not like this. It wants the owner to be apache, as per wp-admin/includes/file.php:

    // Attempt to determine the file owner of the WordPress files, and that of newly created files
   $wp_file_owner = $temp_file_owner = false;
   if ( function_exists('fileowner') ) {
      $wp_file_owner = @fileowner( __FILE__ );
      $temp_file_owner = @fileowner( $temp_file_name );
  }

Yours would be:
wp_file_owner = root
temp_file_owner = apache

if ( $wp_file_owner !== false && $wp_file_owner === $temp_file_owner ) {
    // WordPress is creating files as the same owner as the WordPress files,
    // this means it's safe to modify & create new files via PHP.
    $method = 'direct';
    $GLOBALS['_wp_filesystem_direct_method'] = 'file_owner';
} elseif ( $allow_relaxed_file_ownership ) {
    // The $context directory is writable, and $allow_relaxed_file_ownership is set, this means we can modify files
    // safely in this directory. This mode doesn't create new files, only alter existing ones.
    $method = 'direct';
    $GLOBALS['_wp_filesystem_direct_method'] = 'relaxed_ownership';
}

If $wp_file_owner is same as $temp_file_owner then proceed. Yours would be caught in the elseif, which according to the comment does not allow delete/create, but only updates (I verified this by updating the code of a plugin from within Wordpress, and it worked).

Note I did not extensively look through the code, this is just my quick interpretation. I had the same problem and once I switched user:group so that the httpd user is also the file owner, it did not prompt for FTP credentials anymore.

3
  • 1
    Yup, changing the owner to www-data worked for me. Funny WordPress!
    – ankush981
    Aug 30 '18 at 3:45
  • interesting find, i will look into that... thank you +1 from me)
    – alexus
    Dec 16 '19 at 17:07
  • 1
    Just in case anyone's having this problem - this only worked if I changed the owner of ALL the WordPress files/directories to my webserver user. Just changing the wp-content directory and all its children did not solve the problem. I had to recursively change the wordpress root directory and all children for it to work.
    – Ambulare
    Feb 5 at 14:29
1

Not a direct answer, but probably has to be said - this is one problem you should avoid solving unless you are talking about a local development in which case you can just set permissions to 777.

The reason is that if the webserver can overwrite your code, then any malicious code running on it will be able to do that as well. The risk is just so much bigger than the convenience of saving few seconds by not having to type the ftp credentials.

0

Although the question is not that new anymore I want to add my two cents on this issue also.

A lot of ppl have Centos(7) on their VPS server and following code lines could solve their problem.

Imho has all to do with SELinux which withholds WordPress from doing it's job as wished. It goes to far to explain what SELinux is and what it does. FYI the introduction starts with:

Security-Enhanced Linux (SELinux) is a mandatory access control (MAC) security mechanism implemented in the kernel.

Only 3 steps to folow:

  • 1 Open a terminal (or access the server through SSH)
  • 2 Add following code line chcon -R -t httpd_sys_content_t /var/www/html/wordpress
  • 3 Add second code line chcon -R -t httpd_sys_rw_content_t /var/www/html/wordpress

No reboot from the server or restart from any daemon needed.

I won't say it helps everybody but for those who didn't disable SELinux it should be a relieve.

Cheers

Note: Please adjust to your own needs (meaning path to WordPress)

edit: be sure to remove the line define("FS_METHOD", "direct"); when it is/was used in wp-config.php because that's absolutely a no go when above code lines do as wanted.

0

In my case, I solved this by switching from GIT back to FTP mode.

No more warning.

Perhaps that'll help somebody else too.

Not the answer you're looking for? Browse other questions tagged or ask your own question.