Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I think i heard that it might pose a security threat to your site, is that right? Makes it more vulnerable to it getting hacked?

How should I undo this, which files should be chmod to what number?

share|improve this question
5  
How is this a WordPress question? –  Mark Duncan Jul 16 '11 at 15:50

5 Answers 5

My original comment:

Is chmod 777 a good idea? if it's not absolutely necessary (which if your server's users and groups are properly configured it's usually not) then avoid it. is it as terrible and the omg you're gonna get hacked any second now disaster everyone makes it out to be? not quite, but again it depends on your server config. someone has to get to the directory and file ON your server to do damage. anyway, consult your server admins for proper permissions (assuming you're not the admin!).

and your follow up question:

So i should ask my web host about this? I thought there would a universal permission configuration, especially for wordpress....

Yes, you should ask your host if you are unsure. WordPress does have a universal configuration, in the sense that permissions must be such that WordPress is able write to the filesystem. The variables are how users and groups are configured on a particular server regarding the webserver software, php, and you as a user.

share|improve this answer

Whether your website is based on WordPress or not this is a very very bad idea.

share|improve this answer
    
How should I undo this, which files should be CHMOD to what number? –  user6133 Jul 16 '11 at 16:16
5  
Is chmod 777 a good idea? if it's not absolutely necessary (which if your server's users and groups are properly configured it's usually not) then avoid it. is it as terrible and the omg you're gonna get hacked any second now disaster everyone makes it out to be? not quite, but again it depends on your server config. someone has to get to the directory and file ON your server to do damage. anyway, consult your server admins for proper permissions (assuming you're not the admin!). –  Milo Jul 16 '11 at 16:22
    
So i should ask my web host about this? I thought there would a universal permission configuration, especially for wordpress.... –  user6133 Jul 16 '11 at 16:27
    
@Milo: You should really post that as an answer. –  scribu Jul 16 '11 at 18:04

It's a terrible idea. 777 allows read, write, and execute privileges to anyone and everyone. Do I need to explain why this is a bad idea?

share|improve this answer
    
Yes you do, because your current answer is a little confusing. Anyone / everyone shouldn't be able to reach the stage where they can write or execute something that they are normally not allowed to. But if they do, it's because of badly written scripts. More restrictive permissions can prevent the attacker from removing or executing certain scripts, but he will most likely still be able to upload his scripts somewhere else and execute them –  onetrickpony Sep 26 '11 at 15:36

Yes it is almost always a bad idea, unfortunately sometimes it is the only option left. The more complicated permissions can be done with ACLs, which I would prefer to chmod 777. I work as a Linux Systems Administrator, and there has only been a few specific circumstances chmod 777 was required.

I assume your running *nix, and /var/www is your webroot. to reset the site to sane permissions, I would run.

find /var/www/ -type d -print0 | xargs -0 chmod 755
find /var/www/ -type f -print0 | xargs -0 chmod 644

this assumes your webserver runs as a your normal user. If your webserver runs as the user "jonsmith", and your user:group is jonsmith:jonsmith then this is, although not the absolute best, better than chmod 777.

If your webserver runs as the user "www-data", and your files are placed by your system user "jonsmith" then i would run this also.

chown jonsmith:jonsmith -R /var/www/
chown www-data:www-data -R /var/www/wp-content/

this would make just your wp-content directory writable by the webserver. You will have to change those names/webroots to your situation. This should push you in the right direction.

share|improve this answer

yes its the worst idea ever. one example: this is why i see customers coming in stating "my server is sending lots of email from www-data@hostname.com" ( replace hostname with the server name ) had one today, with 389000 porn related spam emails in the mail queue. sending from a user called anonymous@hostname which was actually the user www-data ( apache ) i did a bit of work and found the site that was compromised and it had an includes directory that had everything set to 777 permissions including a php mail form. then i had to go through and install qmail-remove since qmail does not have a native script for flushing the mail queue.... needless to say this isint in my job description... but the customer was incredibly happy.

if you have hosting some place check permissions of the files if you see something like root : root change this to user : apache or user : www-data then the issue should go away. and you should be able to run with octal permission values of 644. on a side note.... for the love of god people fix your php date.timezone!!!!! its annoying to see in the logs. and it takes two seconds to change.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.