Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I have just started out with a VPS running centos 6.3 to host my blog and play around. After Installing WordPress 3.5.1, when I tried to install some plugins from the admin console, it complained of the folders in wp-content (upgrades, plugins, themes ..) not being writable. I changed the owner and group of these folders to 'apache' which didn't work and then made the ftp user the owner which worked.

After this, I installed the BackWpup plugin which required the wp-content itself to be writable by 'apache' (owning by ftp user account did't work).

In the end I have folder permissions like below

[krishnaraj@myhost]$ pwd
/var/www/html/krishnaraj.mydomain.com/wp-content
[krishnaraj@myhost]$ ls -lrt
total 28
-rw-r--r-- 1 root   root                28 Feb  3 03:08 index.php
drwxr-xr-x 2 apache apache            4096 Feb  3 03:11 cache
drwxr-xr-x 4 apache apache            4096 Feb  3 06:52 uploads
drwxrwxr-x 5 myftpuser myftpuser      4096 Feb  3 07:22 themes
drwxrwxr-x 7 myftpuser myftpuser      4096 Feb  3 09:14 plugins
drwxrwxr-x 2 myftpuser myftpuser      4096 Feb  3 09:14 upgrade
drwxr-xr-x 2 apache apache            4096 Feb  3 09:32 backwpup-98372-logs
[krishnaraj@myhost wp-content]$

[krishnaraj@myhost]$ pwd           
/var/www/html/krishnaraj.mydomain.com
[krishnaraj@myhost]$ ls -lrt | grep wp-content 
drwxr-xr-x 8 apache apache  4096 Feb  3 09:32 wp-content
[krishnaraj@myhost]$

Are these permissions safe ? or should I be worrying about a security hole ?

share|improve this question
    
The documentation should clear some doubts: Changing_File_Permissions –  brasofilo Feb 3 '13 at 18:52
    
@brasofilo Thanks for the link!. The article seems to suggest to change permissions as per the plugin needs and I think my settings shouldn't be a problem. –  Krishnaraj Feb 3 '13 at 19:50
    
Also as per codex.wordpress.org/Hardening_WordPress, think this is perfectly safe –  Krishnaraj Feb 3 '13 at 20:09
    
Would be great if you wrote an Answer with your findings ;) –  brasofilo Feb 3 '13 at 20:57
    
@brasofilo I actually did but the site said I had to wait 8 hrs :) .. I'll do it now :) –  Krishnaraj Feb 4 '13 at 10:19

1 Answer 1

up vote 2 down vote accepted

As per the following from http://codex.wordpress.org/Hardening_WordPress#File_Permissions

/wp-content/
User-supplied content: intended to be completely writable by all users (owner/user, group, and public).

Within /wp-content/ you will find:

/wp-content/themes/
Theme files. If you want to use the built-in theme editor, all files need to be group writable. If you do not want to use the built-in theme editor, all files can be writable only by your user account.
/wp-content/plugins/
Plugin files: all files should be writable only by your user account.

my permissions should be perfectly fine.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.