I have hardened my Wordpress settings as follows:
- All files/directories are owned by my user account (myUserName) and are group-owned by my web server (http) -- myUserName:http
- All folders have 755 permissions, except 'wp-content' and its folder children which have 775 permissions
- All files have 644 permissions, except files within wp-content which have 664 permissions
- wp-config file has 640 permissions
The problem is that with the above settings, I cannot update anything from Wordpress (plugins, themes, etc). It first forces an FTP prompt rather than directly updating the files, and after entering my FTP user credentials it errors out (can't copy file, can't connect to __, and others...).
The only way I am able to get the site to update without an FTP prompt and also to update without any errors is by changing the ownership settings of the entire Wordpress directory and files to the user:group of the web server itself ('http:http').
- Isn't this a security risk to have the web server directly own the WP directory/files rather than simply allowing group ownership settings to extend rights to the web server (per my initial efforts)?
- Why do my group ownership settings not work? The entire site is group-owned by 'http' (which is both the user and group for my web server), and the permission settings for wp-content where these things get updated (775 for folders and 664 for files) give the web server read/write access
- If I temporarily grant the entire WP directory 777 permissions (I know this is bad, but just for testing's sake), then I still cannot get the web server to update files. It is ONLY when I actually change the direct ownership of the directory to that of the web server that is is capable of updating using the one-button update buttons on the wp-admin pages.
