How to Allow FTP Access for Developers on WordPress Sites

Post Date: February 07, 2019
Last Updated: October 07, 2026

Introduction

WordPress developers may sometimes face issues when uploading files through FTP or installing, updating, or deleting plugins from the WordPress admin dashboard.

These issues are commonly caused by incorrect ownership or file and directory permissions on the WordPress installation.

In this guide, we will explain how to create a dedicated developer user, assign the appropriate web server group, and configure WordPress file ownership and permissions so that developers can work with the website without unnecessary permission-related issues.

Prerequisites

Before making these changes, make sure you have the following:

Server Access

You need SSH access to the Linux server with root or sudo privileges.

WordPress Installation

You should know the document root of the WordPress website.

For example:

/var/www/pheonixsolutions.com

Web Server User and Group

Identify the user and group used by your web server.

Common examples include:

apache
www-data

You can check the running web server processes to identify the appropriate user.

Important: The exact user and group depend on your operating system and web server configuration.

Implementation

1. Create a Dedicated Developer User

Create a separate Linux user for developers instead of sharing an existing server account.

sudo useradd devs

Set a strong password:

sudo passwd devs

Enter the password when prompted.

Using a dedicated account makes it easier to manage and revoke developer access when required.

2. Set the User’s Home Directory

Set the WordPress document root as the developer user’s home directory:

sudo usermod -d /var/www/pheonixsolutions.com devs

Replace the path with the actual WordPress document root on your server.

3. Add the Developer User to the Web Server Group

First, identify the group used by the web server.

For example, if the web server uses the apache group:

sudo usermod -aG apache devs

On Debian or Ubuntu-based systems, the group may instead be www-data:

sudo usermod -aG www-data devs

Note: Use -aG instead of -g when adding the user to an additional group. This prevents accidentally replacing the user’s existing primary group.

4. Change WordPress File Ownership

Navigate to the WordPress document root:

cd /var/www/pheonixsolutions.com

Set the appropriate user and web server group as the ownership:

sudo chown -R devs:apache /var/www/pheonixsolutions.com

If your web server uses www-data, use:

sudo chown -R devs:www-data /var/www/pheonixsolutions.com

Replace devs, apache, and the document root with the values appropriate for your server.

5. Set File Permissions

Set permissions for WordPress files:

sudo find /var/www/pheonixsolutions.com -type f -exec chmod 664 {} \;

Set permissions for WordPress directories:

sudo find /var/www/pheonixsolutions.com -type d -exec chmod 775 {} \;

These permissions allow the owner and group to modify files while maintaining separate permissions for other users.

6. Verify Ownership and Permissions

Verify the ownership of the WordPress installation:

ls -la /var/www/pheonixsolutions.com

You can also check specific files or directories:

ls -la /var/www/pheonixsolutions.com/wp-content

Make sure the expected developer user and web server group are shown.

7. Test FTP Access

After completing the configuration, connect to the server using the developer’s FTP/SFTP credentials and verify that the user can access the required WordPress directory.

Test common operations such as:

Uploading a file
Modifying a file
Creating a directory
Uploading a plugin
Updating a plugin
Removing files when required

Security Recommendation: Whenever possible, use SFTP over SSH instead of traditional FTP. SFTP encrypts credentials and data during transmission, whereas standard FTP does not provide encryption.

Conclusion

Providing developers with dedicated access to a WordPress installation requires properly configured user accounts, group membership, ownership, and file permissions.

By creating a dedicated developer account and configuring the WordPress files with appropriate ownership and permissions, developers can perform required file operations and manage WordPress plugins without encountering common permission-related issues.

For production environments, avoid granting more access than necessary and prefer SFTP over unencrypted FTP.

Frequently Asked Questions

Why can’t developers upload files to WordPress?

Incorrect file ownership or permissions are common causes. The web server user, developer account, and WordPress file permissions need to be configured appropriately.

Should I create a separate Linux user for each developer?

Yes. Creating separate accounts is generally better than sharing one account because access can be managed and revoked individually.

Should I use FTP or SFTP?

SFTP is recommended because it encrypts the connection and protects credentials and transferred data.

What is the difference between `apache` and `www-data`?

They are commonly used web server users or groups, depending on the Linux distribution and web server configuration. CentOS/RHEL-based systems commonly use apache, while Debian/Ubuntu systems commonly use www-data.

Why use `usermod -aG` instead of `usermod -g`?

-aG adds the user to a supplementary group without removing existing supplementary group memberships. Using -g changes the user’s primary group.

Are 664 and 775 suitable for every WordPress installation?

They are commonly used permissions, but the correct permissions depend on the server architecture, deployment process, security requirements, and ownership model. Avoid applying broad permissions such as 777 simply to resolve permission problems.

Need Help Managing WordPress Server Access?

Need help configuring secure developer access for your WordPress websites? Our team can assist with WordPress server configuration, SFTP access, Linux user and group management, file permissions, security hardening, troubleshooting, and ongoing server administration. Get in touch with our team here.

Post Views: 159