---
title: "Storing FTP credentials for automatic updates"
date: "2015-09-01"
category: "wordpress"
slug: "storing-ftp-credentials-for-automatic-updates"
---

## Overview

Since WordPress 3.7, updates can occur [automatically in the background](https://codex.wordpress.org/Configuring_Automatic_Background_Updates) without user intervention. However, on ApisCP's dual-user security model, WordPress needs FTP credentials stored in its configuration to perform these automatic updates. Without them, you must [[updating-wordpress]] manually.

## Adding FTP Credentials

Edit `wp-config.php` in the [[where-is-site-content-served-from]] of your WordPress installation. Add the following lines to the end of the file:

/\*\* Setup FTP Details \*\*/
define("FTP\_HOST", "localhost");
define("FTP\_USER", "your-ftp-username");
define("FTP\_PASS", "your-ftp-password");

Replace `your-ftp-username` and `your-ftp-password` with your [[accessing-ftp-server]] credentials. Leave `FTP_HOST` set to `localhost`.

## Security Considerations

Storing FTP credentials in `wp-config.php` means that anyone with read access to that file -- including the web server process -- can view those credentials. To limit exposure:

- Create a dedicated FTP user via **User** > **Add User** in the control panel specifically for managing web files
- Do not use your primary account credentials
- If the WordPress installation is compromised, the attacker gains access only to that FTP user's permissions, not your master control panel login
