WordPress plugins live in one menu, one folder and one set of WP-CLI commands. Which one you need depends on what you are trying to do: Plugins → Installed Plugins in the dashboard to manage them, Plugins → Add New to install, wp-content/plugins/ over SFTP to reach the files, and wp plugin commands over SSH when the admin is slow or broken.
This guide covers all four routes, what to do when the Plugins menu is missing entirely, the errors you will hit while installing, and how to get your site back when a plugin has locked you out of it.
The dashboard route
Log in and go to Plugins → Installed Plugins, or open /wp-admin/plugins.php directly. That screen lists every plugin on the site with its version, author and update status, and gives you the bulk actions that matter: Activate, Deactivate, Update and Delete.
To add one, go to Plugins → Add New (/wp-admin/plugin-install.php). You get four ways in:
- Search the official directory by name or by what it does.
- Featured, Popular, Recommended and Favorites tabs for browsing, plus any extra tabs a plugin on your site has registered.
- Upload Plugin — install a .zip you have bought or downloaded elsewhere. Upload, then click Install Now, then Activate.
- Install from a URL in some setups, if a host or plugin exposes it.
Two more screens belong to this route. Plugins → Plugin File Editor lets you edit plugin PHP in the browser, and only appears when file editing has not been disabled. And Dashboard → Updates lists plugin updates alongside core and themes.
Who is allowed to see any of this
The Plugins menu is gated by capabilities, not by a setting you can toggle. By default:
| Capability | What it allows | Roles that have it by default |
|---|---|---|
activate_plugins |
Activate and deactivate plugins | Administrator only |
install_plugins |
Install new plugins, including uploads | Administrator only |
update_plugins |
Update installed plugins | Administrator only |
delete_plugins |
Delete plugin files | Administrator only |
edit_plugins |
Edit plugin code in the browser | Administrator only |
Editors, authors and shop managers do not get any of these. If someone says they “cannot access plugins”, the answer is usually that their role never had the capability, not that something is broken. Our guide to changing a subscriber’s role to administrator shows how the capability set changes with the role, and what that access actually allows.
When the Plugins menu is missing
This is the most common “how do I access plugins” question, and there are six usual causes. Work down the list in order:
| Cause | How to tell | Fix |
|---|---|---|
| Multisite subsite | You see a “My Sites” menu and the site is part of a network | Plugins are managed at Network Admin → Plugins; only super admins can install |
DISALLOW_FILE_MODS is true |
No Add New screen, no update buttons, no file editors | Remove or set the constant to false in wp-config.php, or install via SFTP/WP-CLI instead |
Your role lacks activate_plugins |
You can edit posts but see no Plugins menu at all | Ask an administrator to change your role, or add the capability |
| A management or security plugin hides menus | The menu is missing for one user but present for another | Check white-label and “hide admin menus” settings in that plugin |
| Managed host restriction | Host docs mention a locked plugin set or a custom wp-config |
Install through the host’s tooling, or ask support to allow it |
| Broken admin due to a plugin error | Other menus are also missing, or you see a fatal error | Deactivate the suspect plugin by renaming its folder |
The DISALLOW_FILE_MODS case is worth understanding rather than working around: setting it to true in wp-config.php removes plugin and theme installation and update from the admin, and also disables the plugin and theme file editors. It is a deliberate hardening measure on sites where updates ship through version control or a deployment pipeline, not a bug.
The file route: SFTP, file manager, and where plugins actually live
Every plugin is a folder inside wp-content/plugins/. The folder name is usually the plugin slug, and inside it is a main PHP file with a plugin header comment. That is the whole structure — a plugin can be a single file, but the directory is the convention.
Three ways to reach it:
- SFTP with your host’s credentials, using FileZilla, Cyberduck or Transmit. Navigate to
public_html/wp-content/plugins/on most shared hosts. - Your host’s file manager — in Hostinger’s hPanel that is Files → File Manager, which opens a browser-based file browser rooted at your site.
- WP-CLI, if SSH is available:
wp plugin pathprints the directory, andwp plugin path akismetprints a specific plugin’s folder.
Permissions are where this route goes wrong. Directories should be 755 and files 644, owned by the same user PHP runs as. If you upload a plugin folder as root or with 777 permissions, WordPress may be unable to update it later, and you have widened your attack surface for nothing.
You can also install here without the dashboard: upload the plugin folder, then activate it from the Plugins screen. If the folder is nested — plugins/my-plugin/my-plugin/ — WordPress will not see it. That is the most common reason a manually uploaded plugin never appears in the list.
The command-line route
WP-CLI is the fastest way into plugins on any host that gives you SSH, and it works when the admin is unusable:
# What is installed
wp plugin list
wp plugin list --status=active
wp plugin list --update=available
# Install and activate
wp plugin install wordfence --activate
wp plugin install ./plugin.zip --activate
# Housekeeping
wp plugin update --all
wp plugin deactivate --all
wp plugin delete hello
# Where the files are
wp plugin pathTwo cautions. wp plugin deactivate --all will take down anything your theme or another plugin depends on, so run it on a staging copy first. And wp plugin update --all on a live site is an untested update by definition — take a backup, or run it on staging and promote.
Errors you will hit while installing
| Message | What it means | Fix |
|---|---|---|
| “Could not create directory” | WordPress cannot write to wp-content/plugins |
Correct ownership and set 755; if the host blocks direct writes, set FS_METHOD to direct and test |
| “Destination folder already exists” | A previous attempt left a partial folder | Delete the leftover folder over SFTP, then reinstall |
| “The uploaded file exceeds upload_max_filesize” | The zip is larger than PHP allows | Raise upload_max_filesize and post_max_size, or install over SFTP/WP-CLI |
| “The link you followed has expired” | Usually the same upload limit, hit before the nonce check completes | Same fix: raise the limits or use WP-CLI |
| Plugin installs but never appears | The zip contained a nested folder | Move the inner folder up one level |
Access when a plugin has locked you out
If a plugin is causing a white screen or a fatal error that blocks /wp-admin, you do not need to fix the plugin to get in. Rename its folder — wp-content/plugins/some-plugin to some-plugin.disabled — and WordPress deactivates it automatically because the plugin file it expects is gone. That single rename is the fastest recovery available, and it works even when the dashboard does not.
Since WordPress 5.2 there is also recovery mode: when a fatal error is caused by a plugin or theme, WordPress emails the admin address a link that lets you get into the dashboard with plugins paused. It only works if email delivery works and you can read that inbox, so it is a supplement to file access, not a replacement.
Who should have plugin access
Plugin access is effectively server access. Installing a plugin means running code someone else wrote on your host, with your database credentials. That is why the capability is administrator-only by default and should stay that way.
- Give administrators plugin access to the people who actually own the site’s software decisions, on their own accounts.
- Give editors nothing. If an editor needs a feature a plugin provides, that is a request to an administrator, not a capability to grant.
- Never share SFTP credentials as a workaround for a missing menu. Use a separate account and revoke it when the job is done.
Day to day, the simpler answer is that plugins need maintaining: updates tested, conflicts caught, abandoned plugins replaced. That work is on the $99 care plan (updates tested before release, weekly malware scans, broken-site fixes) and expanded on the Advanced tier with staging before every update. If you only need the install mechanics, our walkthrough of how to install WordPress plugins covers the safe order of operations, and what a WordPress site costs puts plugin licences in context.
FAQ
How do I access WordPress plugin files?
Over SFTP or your host’s file manager, in wp-content/plugins/. Or run wp plugin path with WP-CLI to print the directory. Each plugin has its own folder inside it.
Why is there no Plugins menu in my dashboard?
In order of likelihood: your role lacks activate_plugins, the site is multisite and plugins are managed at network level, DISALLOW_FILE_MODS is set in wp-config.php, or a management plugin is hiding the menu.
Can I install plugins without dashboard access?
Yes. Upload the plugin folder over SFTP into wp-content/plugins/, or run wp plugin install <slug> --activate. Both bypass the admin entirely.
Is it safe to use the Plugin File Editor?
It is a live code editor with no undo. One missing semicolon takes the site down, and the editor itself is a privilege-escalation path if an admin account is ever compromised. Most sites are better off with DISALLOW_FILE_EDIT set to true and edits made in a proper editor over SFTP.
Does deactivating a plugin delete its data?
No. Deactivating stops the code running; deleting removes the files. Settings and database tables usually survive both, which is why a plugin you deleted a year ago can still be leaving rows behind in your database.
If the plugin you are about to install is a membership or security tool, the comparisons of the best membership plugins and the top security plugins narrow the field first.
