* Filters the filesystem method to use.
* @param string $method Filesystem method to return.
* @param array $args An array of connection details for the method.
* @param string $context Full path to the directory that is tested for being writable.
* @param bool $allow_relaxed_file_ownership Whether to allow Group/World writable.
return apply_filters( 'filesystem_method', $method, $args, $context, $allow_relaxed_file_ownership );
* Displays a form to the user to request for their FTP/SSH details in order
* to connect to the filesystem.
* All chosen/entered details are saved, excluding the password.
* Hostnames may be in the form of hostname:portnumber (eg: wordpress.org:2467)
* to specify an alternate FTP/SSH port.
* Plugins may override this form by returning true|false via the {@see 'request_filesystem_credentials'} filter.
* @since 4.6.0 The `$context` parameter default changed from `false` to an empty string.
* @global string $pagenow
* @param string $form_post The URL to post the form to.
* @param string $type Optional. Chosen type of filesystem. Default empty.
* @param bool|WP_Error $error Optional. Whether the current request has failed
* to connect, or an error object. Default false.
* @param string $context Optional. Full path to the directory that is tested
* for being writable. Default empty.
* @param array $extra_fields Optional. Extra `POST` fields to be checked
* for inclusion in the post. Default null.
* @param bool $allow_relaxed_file_ownership Optional. Whether to allow Group/World writable.
* @return bool|array True if no filesystem credentials are required,
* false if they are required but have not been provided,
* array of credentials if they are required and have been provided.
function request_filesystem_credentials( $form_post, $type = '', $error = false, $context = '', $extra_fields = null, $allow_relaxed_file_ownership = false ) {
* Filters the filesystem credentials.
* Returning anything other than an empty string will effectively short-circuit
* output of the filesystem credentials form, returning that value instead.
* A filter should return true if no filesystem credentials are required, false if they are required but have not been
* provided, or an array of credentials if they are required and have been provided.
* @since 4.6.0 The `$context` parameter default changed from `false` to an empty string.
* @param mixed $credentials Credentials to return instead. Default empty string.
* @param string $form_post The URL to post the form to.
* @param string $type Chosen type of filesystem.
* @param bool|WP_Error $error Whether the current request has failed to connect,
* @param string $context Full path to the directory that is tested for
* @param array $extra_fields Extra POST fields.
* @param bool $allow_relaxed_file_ownership Whether to allow Group/World writable.
$req_cred = apply_filters( 'request_filesystem_credentials', '', $form_post, $type, $error, $context, $extra_fields, $allow_relaxed_file_ownership );
if ( '' !== $req_cred ) {
$type = get_filesystem_method( array(), $context, $allow_relaxed_file_ownership );
if ( 'direct' === $type ) {
if ( is_null( $extra_fields ) ) {
$extra_fields = array( 'version', 'locale' );
$credentials = get_option(
$submitted_form = wp_unslash( $_POST );
// Verify nonce, or unset submitted form field values on failure.
if ( ! isset( $_POST['_fs_nonce'] ) || ! wp_verify_nonce( $_POST['_fs_nonce'], 'filesystem-credentials' ) ) {
$submitted_form['hostname'],
$submitted_form['username'],
$submitted_form['password'],
$submitted_form['public_key'],
$submitted_form['private_key'],
$submitted_form['connection_type']
// If defined, set it to that. Else, if POST'd, set it to that. If not, set it to whatever it previously was (saved details in option).
$credentials['hostname'] = defined( 'FTP_HOST' ) ? FTP_HOST : ( ! empty( $submitted_form['hostname'] ) ? $submitted_form['hostname'] : $credentials['hostname'] );
$credentials['username'] = defined( 'FTP_USER' ) ? FTP_USER : ( ! empty( $submitted_form['username'] ) ? $submitted_form['username'] : $credentials['username'] );
$credentials['password'] = defined( 'FTP_PASS' ) ? FTP_PASS : ( ! empty( $submitted_form['password'] ) ? $submitted_form['password'] : '' );
// Check to see if we are setting the public/private keys for ssh.
$credentials['public_key'] = defined( 'FTP_PUBKEY' ) ? FTP_PUBKEY : ( ! empty( $submitted_form['public_key'] ) ? $submitted_form['public_key'] : '' );
$credentials['private_key'] = defined( 'FTP_PRIKEY' ) ? FTP_PRIKEY : ( ! empty( $submitted_form['private_key'] ) ? $submitted_form['private_key'] : '' );
// Sanitize the hostname, some people might pass in odd data.
$credentials['hostname'] = preg_replace( '|\w+://|', '', $credentials['hostname'] ); // Strip any schemes off.
if ( strpos( $credentials['hostname'], ':' ) ) {
list( $credentials['hostname'], $credentials['port'] ) = explode( ':', $credentials['hostname'], 2 );
if ( ! is_numeric( $credentials['port'] ) ) {
unset( $credentials['port'] );
unset( $credentials['port'] );
if ( ( defined( 'FTP_SSH' ) && FTP_SSH ) || ( defined( 'FS_METHOD' ) && 'ssh2' === FS_METHOD ) ) {
$credentials['connection_type'] = 'ssh';
} elseif ( ( defined( 'FTP_SSL' ) && FTP_SSL ) && 'ftpext' === $type ) { // Only the FTP Extension understands SSL.
$credentials['connection_type'] = 'ftps';
} elseif ( ! empty( $submitted_form['connection_type'] ) ) {
$credentials['connection_type'] = $submitted_form['connection_type'];
} elseif ( ! isset( $credentials['connection_type'] ) ) { // All else fails (and it's not defaulted to something else saved), default to FTP.
$credentials['connection_type'] = 'ftp';
&& ( ( ! empty( $credentials['password'] ) && ! empty( $credentials['username'] ) && ! empty( $credentials['hostname'] ) )
|| ( 'ssh' === $credentials['connection_type'] && ! empty( $credentials['public_key'] ) && ! empty( $credentials['private_key'] ) )
$stored_credentials = $credentials;
if ( ! empty( $stored_credentials['port'] ) ) { // Save port as part of hostname to simplify above code.
$stored_credentials['hostname'] .= ':' . $stored_credentials['port'];
unset( $stored_credentials['password'], $stored_credentials['port'], $stored_credentials['private_key'], $stored_credentials['public_key'] );
if ( ! wp_installing() ) {
update_option( 'ftp_credentials', $stored_credentials );
$hostname = isset( $credentials['hostname'] ) ? $credentials['hostname'] : '';
$username = isset( $credentials['username'] ) ? $credentials['username'] : '';
$public_key = isset( $credentials['public_key'] ) ? $credentials['public_key'] : '';
$private_key = isset( $credentials['private_key'] ) ? $credentials['private_key'] : '';
$port = isset( $credentials['port'] ) ? $credentials['port'] : '';
$connection_type = isset( $credentials['connection_type'] ) ? $credentials['connection_type'] : '';
$error_string = __( '<strong>Error</strong>: Could not connect to the server. Please verify the settings are correct.' );
if ( is_wp_error( $error ) ) {
$error_string = esc_html( $error->get_error_message() );
echo '<div id="message" class="error"><p>' . $error_string . '</p></div>';
if ( extension_loaded( 'ftp' ) || extension_loaded( 'sockets' ) || function_exists( 'fsockopen' ) ) {
$types['ftp'] = __( 'FTP' );
if ( extension_loaded( 'ftp' ) ) { // Only this supports FTPS.
$types['ftps'] = __( 'FTPS (SSL)' );
if ( extension_loaded( 'ssh2' ) ) {
$types['ssh'] = __( 'SSH2' );
* Filters the connection types to output to the filesystem credentials form.
* @since 4.6.0 The `$context` parameter default changed from `false` to an empty string.
* @param string[] $types Types of connections.
* @param array $credentials Credentials to connect with.
* @param string $type Chosen filesystem method.
* @param bool|WP_Error $error Whether the current request has failed to connect,
* @param string $context Full path to the directory that is tested for being writable.
$types = apply_filters( 'fs_ftp_connection_types', $types, $credentials, $type, $error, $context );
<form action="<?php echo esc_url( $form_post ); ?>" method="post">
<div id="request-filesystem-credentials-form" class="request-filesystem-credentials-form">
// Print a H1 heading in the FTP credentials modal dialog, default is a H2.
if ( 'plugins.php' === $pagenow || 'plugin-install.php' === $pagenow ) {
echo "<$heading_tag id='request-filesystem-credentials-title'>" . __( 'Connection Information' ) . "</$heading_tag>";
<p id="request-filesystem-credentials-desc">
$label_user = __( 'Username' );
$label_pass = __( 'Password' );
_e( 'To perform the requested action, WordPress needs to access your web server.' );
if ( ( isset( $types['ftp'] ) || isset( $types['ftps'] ) ) ) {
if ( isset( $types['ssh'] ) ) {
_e( 'Please enter your FTP or SSH credentials to proceed.' );
$label_user = __( 'FTP/SSH Username' );
$label_pass = __( 'FTP/SSH Password' );
_e( 'Please enter your FTP credentials to proceed.' );
$label_user = __( 'FTP Username' );
$label_pass = __( 'FTP Password' );
_e( 'If you do not remember your credentials, you should contact your web host.' );
$hostname_value = esc_attr( $hostname );
if ( ! empty( $port ) ) {
$hostname_value .= ":$port";
if ( defined( 'FTP_PASS' ) ) {
$password_value = '*****';
<span class="field-title"><?php _e( 'Hostname' ); ?></span>
<input name="hostname" type="text" id="hostname" aria-describedby="request-filesystem-credentials-desc" class="code" placeholder="<?php esc_attr_e( 'example: www.wordpress.org' ); ?>" value="<?php echo $hostname_value; ?>"<?php disabled( defined( 'FTP_HOST' ) ); ?> />
<div class="ftp-username">
<span class="field-title"><?php echo $label_user; ?></span>
<input name="username" type="text" id="username" value="<?php echo esc_attr( $username ); ?>"<?php disabled( defined( 'FTP_USER' ) ); ?> />
<div class="ftp-password">
<span class="field-title"><?php echo $label_pass; ?></span>
<input name="password" type="password" id="password" value="<?php echo $password_value; ?>"<?php disabled( defined( 'FTP_PASS' ) ); ?> />
if ( ! defined( 'FTP_PASS' ) ) {
_e( 'This password will not be stored on the server.' );}
<legend><?php _e( 'Connection Type' ); ?></legend>
$disabled = disabled( ( defined( 'FTP_SSL' ) && FTP_SSL ) || ( defined( 'FTP_SSH' ) && FTP_SSH ), true, false );
foreach ( $types as $name => $text ) :
<label for="<?php echo esc_attr( $name ); ?>">
<input type="radio" name="connection_type" id="<?php echo esc_attr( $name ); ?>" value="<?php echo esc_attr( $name ); ?>" <?php checked( $name, $connection_type ); ?> <?php echo $disabled; ?> />
if ( isset( $types['ssh'] ) ) {
if ( 'ssh' !== $connection_type || empty( $connection_type ) ) {
$hidden_class = ' class="hidden"';
<fieldset id="ssh-keys"<?php echo $hidden_class; ?>>
<legend><?php _e( 'Authentication Keys' ); ?></legend>
<span class="field-title"><?php _e( 'Public Key:' ); ?></span>
<input name="public_key" type="text" id="public_key" aria-describedby="auth-keys-desc" value="<?php echo esc_attr( $public_key ); ?>"<?php disabled( defined( 'FTP_PUBKEY' ) ); ?> />
<label for="private_key">
<span class="field-title"><?php _e( 'Private Key:' ); ?></span>
<input name="private_key" type="text" id="private_key" value="<?php echo esc_attr( $private_key ); ?>"<?php disabled( defined( 'FTP_PRIKEY' ) ); ?> />
<p id="auth-keys-desc"><?php _e( 'Enter the location on the server where the public and private keys are located. If a passphrase is needed, enter that in the password field above.' ); ?></p>
foreach ( (array) $extra_fields as $field ) {
if ( isset( $submitted_form[ $field ] ) ) {
echo '<input type="hidden" name="' . esc_attr( $field ) . '" value="' . esc_attr( $submitted_form[ $field ] ) . '" />';
<p class="request-filesystem-credentials-action-buttons">
<?php wp_nonce_field( 'filesystem-credentials', '_fs_nonce', false, true ); ?>
<button class="button cancel-button" data-js-action="close" type="button"><?php _e( 'Cancel' ); ?></button>
<?php submit_button( __( 'Proceed' ), '', 'upgrade', false ); ?>
* Prints the filesystem credentials modal when needed.
function wp_print_request_filesystem_credentials_modal() {
$filesystem_method = get_filesystem_method();
$filesystem_credentials_are_stored = request_filesystem_credentials( self_admin_url() );
$request_filesystem_credentials = ( 'direct' !== $filesystem_method && ! $filesystem_credentials_are_stored );
if ( ! $request_filesystem_credentials ) {
<div id="request-filesystem-credentials-dialog" class="notification-dialog-wrap request-filesystem-credentials-dialog">
<div class="notification-dialog-background"></div>
<div class="notification-dialog" role="dialog" aria-labelledby="request-filesystem-credentials-title" tabindex="0">
<div class="request-filesystem-credentials-dialog-content">
<?php request_filesystem_credentials( site_url() ); ?>
* Attempts to clear the opcode cache for an individual PHP file.
* This function can be called safely without having to check the file extension
* or availability of the OPcache extension.
* Whether or not invalidation is possible is cached to improve performance.
* @link https://www.php.net/manual/en/function.opcache-invalidate.php
* @param string $filepath Path to the file, including extension, for which the opcode cache is to be cleared.
* @param bool $force Invalidate even if the modification time is not newer than the file in cache.
* @return bool True if opcache was invalidated for `$filepath`, or there was nothing to invalidate.
* False if opcache invalidation is not available, or is disabled via filter.
function wp_opcache_invalidate( $filepath, $force = false ) {
static $can_invalidate = null;
* Check to see if WordPress is able to run `opcache_invalidate()` or not, and cache the value.
* First, check to see if the function is available to call, then if the host has restricted
* the ability to run the function to avoid a PHP warning.
* `opcache.restrict_api` can specify the path for files allowed to call `opcache_invalidate()`.
* If the host has this set, check whether the path in `opcache.restrict_api` matches
* the beginning of the path of the origin file.
* `$_SERVER['SCRIPT_FILENAME']` approximates the origin file's path, but `realpath()`
* is necessary because `SCRIPT_FILENAME` can be a relative path when run from CLI.
* - https://www.php.net/manual/en/opcache.configuration.php
* - https://www.php.net/manual/en/reserved.variables.server.php
* - https://core.trac.wordpress.org/ticket/36455
if ( null === $can_invalidate
&& function_exists( 'opcache_invalidate' )
&& ( ! ini_get( 'opcache.restrict_api' )
|| stripos( realpath( $_SERVER['SCRIPT_FILENAME'] ), ini_get( 'opcache.restrict_api' ) ) === 0 )
// If invalidation is not available, return early.
if ( ! $can_invalidate ) {
// Verify that file to be invalidated has a PHP extension.
if ( '.php' !== strtolower( substr( $filepath, -4 ) ) ) {
* Filters whether to invalidate a file from the opcode cache.
* @param bool $will_invalidate Whether WordPress will invalidate `$filepath`. Default true.
* @param string $filepath The path to the PHP file to invalidate.
if ( apply_filters( 'wp_opcache_invalidate_file', true, $filepath ) ) {
return opcache_invalidate( $filepath, $force );