Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

Hey guys, I have been spending the longest time trying to figure out this issue. I would like to know what the file permissions should look like in WordPress in order to use the autoupdate feature. As of now, my wordpress installation keeps asking me for my FTP information and I do not want to use that method of upgrading/installing, I want to use pure/direct PHP.

Some context:

  • webserver and php fcgi daemons run as www-data:www-data
  • wordpress installation is at /home/blaenk/sites/domain.tld/

At first, I read that all files/folders should be owned by my user (blaenk) and writable by my user. But this wasn't working, after spending many hours researching, someone on the IRC channel told me to try setting everything to ownership www-data:www-data and this worked. I was no longer asked for FTP information and the plugin installation worked automatically.

However, I originally placed the site files in my home directory precisely because I wanted to be able to write/create them as my user. I even added myself to the www-data directory as stated in this guide.


I already know that files should be 644 and directories should be 755. However, this seems more of an issue of ownership. I don't want to have to set www-data:www-data on everything in my wordpress installation, so I'm wondering what files/directories specifically require this ownership level?

EDIT: I believe that the reason for which everything seems to work on my shared hosting wordpress installation despite all of the files being owned by my user is that the shared host I use seems to use suexec which presumably runs PHP as me, so in other words, the files are owned by the webserver, so to speak.

share|improve this question

2 Answers 2

As far as I understand it is not related to specific permissions - Auto Update overall requires that files owner matches user Apache runs under. If that is not the case it falls back to other filesystem methods (FTP, SSH) and so prompts for password.

You can define credentials in constants in wp-config.php so you don't get prompted for them.

See WordPress Upgrade Constants in Codex.

share|improve this answer
Thank you Rarst. I have seen that codex article, however, I absolutely do not want to use FTP/SSH. The reason for this is that somehow, on a shared-hosting site where I installed wordpress manually as well, everything works, even though everything is owned by my own user. Things are owned by my user, but also by another group which I didn't create, so I imagine there is some SETGUID stuff going on here, which is probably how the webserver process is able to run auto update. –  Jorge Israel Peña Dec 23 '10 at 9:13
My guess is your other configuration is using suexec so Apache runs WordPress under your user account and there is no mismatch. –  Rarst Dec 23 '10 at 9:21
Haha, yeah, that's what I said. I'll give it to you since you're the only one that bothered to reply though. Thanks :) –  Jorge Israel Peña Dec 23 '10 at 9:29
Well, it isn't even a hour since your question and there is no really perfect answer - either you make user match or use FTP/SSH. By the way rather than adding solution to your question could you please write it out as an answer with some links on topic and such? So others can benefit from it in the future. –  Rarst Dec 23 '10 at 9:34
No, this is absolutely fine. :) System works to collect and promote great and accurate answers whomever they come from. Multiple answers are good and can highlight different aspects of question. –  Rarst Dec 23 '10 at 9:59
up vote 1 down vote accepted

In my question, I stated confusion at the fact that everything worked seamlessly on my shared-hosted despite all of the files being owned by my user, whereas on my VPS, the auto upgrade would not work unless all files were owned by the webserver.

I am fairly certain that this is a result of my shared host using suexec which essentially runs the scripts as my user. So essentially, the files on my shared host were owned by the 'web server' (really, the CGI daemon).

I am actually running nginx and php-fpm on my VPS, so I do not have access to Apache's suexec. However, I simply configured php-fpm to run as myself, to test my theory, and it did indeed worked seamlessly with all of the files owned by my user. I believe this would be considered a security risk (not sure), so I will investigate further to see what I can do in this regard to avoid running it as my user, but at least now I know what the problem is!

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.