Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I seem to be having issues with folder (and maybe file) permissions getting changed possibly by an FTP client. The WordPress install is using https. It started primarily with permissions in the wp-content/uploads folder not allowing anything to upload to the Media Library. Changing the uploads folder's permissions to 777 fixes this. Is there any risk in having the uploads folder and/or the entire wp-content folder permissions set to 777? I couldn't seem to find a clear answer at http://codex.wordpress.org/Changing_File_Permissions. Although I assume it changes from host to host.

share|improve this question
    
What are the group and user ownership of the files? What user does PHP run as? –  Chris_O Feb 8 '12 at 1:31
add comment

1 Answer

As listed down the bottom (http://codex.wordpress.org/Changing_File_Permissions#The_dangers_of_777) having 777 permissions allows anybody with know how to go in and modify and execute your code making it available to hackers.

I was reading an article yesterday and it stated that about 80% of all hacks came from uploading/inserting a file into the uploads folder creating a backdoor that they could use to steal information and lock you out etc. So while you may think "it's only my uploads directory" you are making it easier to do the most common hack on your site.

Sorry I can't find the source on my info, have an automatic history cleaner plugin.

EDIT: Found the reference: http://ottopress.com/2009/hacked-wordpress-backdoors/

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.