1

I configured file permissions according to here like this.

apache user runs server and wordpress user owns directory, this user is only used for this site.

drwxr-xr-x  5 wordpress wordpress  4096 Apr 12 01:12 .
drwxr-xr-x 10 root      root       4096 Apr 10 16:19 ..
-rw-r--r--  1 wordpress wordpress   418 Sep 25  2013 index.php
-rw-r--r--  1 wordpress wordpress 19929 Jan 18  2013 license.txt
-rw-r--r--  1 wordpress wordpress  3193 Jan 27 20:18 readme-ja.html
-rw-r--r--  1 wordpress wordpress 10156 Jan 27 20:18 readme.html
-rw-r--r--  1 wordpress wordpress  4892 Oct  4  2013 wp-activate.php
drwxr-xr-x  9 wordpress wordpress  4096 Jan 27 20:18 wp-admin
-rw-r--r--  1 wordpress wordpress   271 Jan  9  2012 wp-blog-header.php
-rw-r--r--  1 wordpress wordpress  4795 Sep  6  2013 wp-comments-post.php
-rw-r--r--  1 wordpress wordpress  4255 Jan 27 20:18 wp-config-sample.php
-r--r-----  1 wordpress wordpress  4471 Apr 12 01:12 wp-config.php
drwxrws---  5 wordpress wordpress  4096 Apr 12 11:41 wp-content
-rw-r--r--  1 wordpress wordpress  2932 Sep 25  2013 wp-cron.php
drwxr-xr-x 12 wordpress wordpress  4096 Jan 27 20:18 wp-includes
-rw-r--r--  1 wordpress wordpress  2380 Oct 25 07:58 wp-links-opml.php
-rw-r--r--  1 wordpress wordpress  2359 Oct 25 07:58 wp-load.php
-rw-r--r--  1 wordpress wordpress 31909 Dec  4 05:12 wp-login.php
-rw-r--r--  1 wordpress wordpress  8235 Nov 13 20:58 wp-mail.php
-rw-r--r--  1 wordpress wordpress 10880 Nov  5 09:24 wp-settings.php
-rw-r--r--  1 wordpress wordpress 25665 Nov 13 12:23 wp-signup.php
-rw-r--r--  1 wordpress wordpress  4026 Oct 25 07:58 wp-trackback.php
-rw-r--r--  1 wordpress wordpress  3015 Oct 25 11:29 xmlrpc.php


$ ls -la wp-content/
total 24
drwxrws--- 5 wordpress wordpress 4096 Apr 12 11:41 .
drwxr-xr-x 5 wordpress wordpress 4096 Apr 12 01:12 ..
-rw-rw---- 1 wordpress wordpress   28 Jan  9  2012 index.php
drwxr-xr-x 3 wordpress wordpress 4096 Jan 27 20:18 languages
drwxr-x--- 4 wordpress wordpress 4096 Jan 27 20:18 plugins
drwxrws--- 5 wordpress wordpress 4096 Jan 27 20:18 themes

And add apache user to wordpress group

$ id apache
uid=48(apache) gid=48(apache) groups=48(apache),503(wordpress)

But with these permissions, I can't update wordpress itself or plugins. Which directory should be writable to update correctly and keep as possible as secure?

  • As a general statement, files should be 664, folders should be 775 and wp-config.php should be 660 – RiddleMeThis Apr 18 at 19:53
  • Less generally, at least your wp-content/plugins folder is missing group write permissions. I see the rws, but you could try pre-creating wp-content/upgrade end setting its permissions explicitly. In the past, I've run into issues when parent folders' permissions didn't match their children (e.g. wp-content has 755 and upgrade has 775) - which shouldn't be an issue in theory, but WP seemed overly picky. If you're concerned about security you could consider updating via shell and/or wp-cli and leave critical dirs read-only to apache. – kubi May 26 at 12:36
0

Tetsu, the Codex has some good insights on this:

http://codex.wordpress.org/Changing_File_Permissions

Unfortunately there is no 'one size fits all' according to the Codex. It may depend on your host.

  • I'm using VPS for hosting Wordpress. Is there at least textbook example how to configure a host for Wordpress, that I can follow? – ironsand Apr 13 '14 at 8:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.