ftp_nlist() and ftp_pwd() warnings

I’m not sure when this warning started. I got an existing site to do its hosting and applied the following good practices:

• Updated WordPress – from 5.3 to 5.4.0 (current WP version)
• Updated all plugins – it’s a big list so I won’t add it here
• Changed file permissions and owner – everything owned by my user (not Apache) and only the folder wp-content is writable by Apache (with some restrictions inside) -> WordPress Hardening Guide

As a note, the Apache user and group are used both by both Apache and PHP-FPM. We only use the server (VM) for this website, so I don’t have to address security challenges related to process sharing.

With these changes, I started having the following PHP warnings (Yes, I did everything at the same time! Sorry for that):

Warning: ftp_nlist() expects parameter 1 to be resource, null given in /var/www/html/wp-admin/includes/class-wp-filesystem-ftpext.php on line 402

Warning: ftp_pwd() expects parameter 1 to be resource, null given in /var/www/html/wp-admin/includes/class-wp-filesystem-ftpext.php on line 226

Warning: ftp_pwd() expects parameter 1 to be resource, null given in /var/www/html/wp-admin/includes/class-wp-filesystem-ftpext.php on line 226

Warning: ftp_pwd() expects parameter 1 to be resource, null given in /var/www/html/wp-admin/includes/class-wp-filesystem-ftpext.php on line 681

Warning: ftp_nlist() expects parameter 1 to be resource, null given in /var/www/html/wp-admin/includes/class-wp-filesystem-ftpext.php on line 402

Warning: ftp_pwd() expects parameter 1 to be resource, null given in /var/www/html/wp-admin/includes/class-wp-filesystem-ftpext.php on line 226

Warning: ftp_pwd() expects parameter 1 to be resource, null given in /var/www/html/wp-admin/includes/class-wp-filesystem-ftpext.php on line 226

Warning: ftp_pwd() expects parameter 1 to be resource, null given in /var/www/html/wp-admin/includes/class-wp-filesystem-ftpext.php on line 681

Warning: ftp_nlist() expects parameter 1 to be resource, null given in /var/www/html/wp-admin/includes/class-wp-filesystem-ftpext.php on line 402

Warning: ftp_pwd() expects parameter 1 to be resource, null given in /var/www/html/wp-admin/includes/class-wp-filesystem-ftpext.php on line 226

Warning: ftp_pwd() expects parameter 1 to be resource, null given in /var/www/html/wp-admin/includes/class-wp-filesystem-ftpext.php on line 226

Warning: ftp_rmdir() expects parameter 1 to be resource, null given in /var/www/html/wp-admin/includes/class-wp-filesystem-ftpext.php on line 381

Warning: ftp_nlist() expects parameter 1 to be resource, null given in /var/www/html/wp-admin/includes/class-wp-filesystem-ftpext.php on line 402

Warning: ftp_pwd() expects parameter 1 to be resource, null given in /var/www/html/wp-admin/includes/class-wp-filesystem-ftpext.php on line 226

Warning: ftp_pwd() expects parameter 1 to be resource, null given in /var/www/html/wp-admin/includes/class-wp-filesystem-ftpext.php on line 226

Warning: ftp_pwd() expects parameter 1 to be resource, null given in /var/www/html/wp-admin/includes/class-wp-filesystem-ftpext.php on line 681

These warnings appear in the PHP-FPM log file in every call to the server. If I set define( 'WP_DEBUG', true ); they can be found in every page.

Steps to solve

I can stop these warnings doing one of the following:

• Disabling the plugins Swift Framework and Redux Framework.
• Setting the file ownership of the WordPress folder to Apache.

None of these changes is the desired solution. The first breaks the site, and the second creates a security problem.

WordPress bug?

I’ve also found the WordPress issue 48689 that describes the same errors but associated with different plugins. However, the solution (if (!defined('FS_METHOD')) define('FS_METHOD', 'direct');) doesn’t work in my case. The remaining options are hiding the warnings don’t seem to be a good idea.

After all, it was already in the question!

Context

Both plugins are related to my WordPress site theme (uplift). I can’t understand what it is doing or where, but when it detects that the owner of the files isn’t its executing user (apache), it changes the access method to FTP.

This action doesn’t seem logical, to me, because even if I do 775 user:apache (pseudo-code), it doesn’t’ work (it is searching for the owner, not if it has permissions). I could do 575 apache:user but in that case, apache can run CHMOD, so it is pointless.

Also, this is happening outside of wp-content. And is not documented by the plugins or theme, which for me, seems a security issue. 0 results for “owner” and “permission” in the documentation.

Solution

Just add define('FS_METHOD', 'direct');.

With a little precaution! This needs to be added before require_once( ABSPATH . 'wp-settings.php' );. Why? Again, no idea. However, this is a requirement for several configurations as you can see by the Editing wp-config.php docs page

Cautions

As stated in this answer, using FS_METHOD can pose a security risk in shared hosting. Not my case, so my investigation ended here.

Missing

Please feel free to answer the following doubts (in the comments or with an answer, I will accept the answer or complement mine, accordingly):

1. What is uplift theme doing? Why do they need to check the owner?
2. Why does the FS_METHOD setting needs to be loaded before the wp-settings.php page?
3. What would be the solution for a shared hosting scenario?