I'm writing a script to automatically check file permissions in all wordpress installations on a server.

This document http://codex.wordpress.org/Hardening_WordPress is unclear on a certain point:


User-supplied content: intended to be writable by your user account and the web server process. Within /wp-content/ you will find:


Theme files. If you want to use the built-in theme editor, all files need to be writable by the web server process. If you do not want to use the built-in theme editor, all files can be writable only by your user account.


Plugin files: all files should be writable only by your user account.

Is that documentation above correct and complete (in all contexts) - can I trust it ?

If so, what does it say:

  • is only the directory wp-content itself writable for both user and webserver, or
  • is anything inside wp-content writable for both, except plugins and optionally themes ?

I think it says the first .. but the uploads folder isnt mentioned, and that should be writable by the webserver, for sure ?

EDIT: slightly rephrased the question


There are several sides to this. What it should be ideally, what is is practically, and what it usually has to be practically.

There are two contexts to the writing files in WordPress.

Just do it with PHP

The locked down hardest scenario here is that only uploads is writable. Otherwise core functionality will start to break down.

However plugins might play loose with it and assume all of wp-content to be writable.

Filesystem API

This is proper way to do writes, but it's also hard on end–user since it asks for FTP credentials if that's what it takes it.

This needs to be able to write everything, or (again) core functionality breaks down and in larger ways (updates, etc).

So to sum it up:

  1. Only uploads should be writable via PHP
  2. If rest of content folder isn't writable third party code might fail
  3. Filesystem API should be able to do whatever, unless you want to lock it down hard to the point of read–only filesystem from WP perspective (some setups do work like that)
| improve this answer | |
  • So contrary to what is mentioned at codex.wordpress.org/Hardening_WordPress, wp-content should ideally not be writable for the webserver, and uploads, which is not mentioned there, must be writable for the webserver ? The documentation is wrong on one end and lacking on another ? – commonpike Aug 3 '14 at 18:01
  • "Should" is fuzzy here. If content isn't writable by server then things like updates would need to go through FTP and ask for credentials. Which of the two is preferred is matter of context rather than hard rules. Personally I just don't obsess about permissions. If web server being able to write to content dir is a "problem" then you got bigger problems than one of permissions. – Rarst Aug 3 '14 at 18:56
  • I cant accept there is only a fuzzy answer here. If wordpress has no standards for security, than all hackers need to do is poke around until they find a hole 'depending on the context'. that cant be true. – commonpike Aug 5 '14 at 10:50
  • If web server being able to write to content dir is a "problem" then you got bigger problems than one of permissions. - yes, bad passswords and evil plugins. But i dont own these sites. All i can do is setup security so, that even evil plugins and users are sandboxed. Thats what permissions are for .. – commonpike Aug 5 '14 at 11:37
  • There is absolutely nothing you can do against evil plugin, if it's installed then site is compromised completely regardless of file permissions. Sandboxing PHP isn't trivial in first place and it's impossible in WP's architecture. – Rarst Aug 5 '14 at 11:47

What would be wrong with this ?

# you own everything
chown -R [user].[user] * .htaccess

# others and group may not write anywhere
chmod -R og-w *

# execute permissions on dirs only
chmod -R a-x *
chmod -R a+X *

# webserver co-owns htaccess
chgrp www-data .htaccess
chmod a-wx .htaccess
chmod u+w .htaccess

# webserver co-owns wp-content and below
chgrp -R www-data wp-content

# webserver may write in wp-content itself
chmod g+w wp-content

# webserver may write in and below uploads
chmod -R g+w wp-content/uploads

# ------------
# custom exceptions below this
# ------------

# webserver may write in htaccess (optional)
# chmod g+w .htaccess

# webserver may write in and below themes (optional)
# chmod -R g+w wp-content/themes
| improve this answer | |
  • AFAICS chmod -R a+x * sets execute permission on everything, not just dirs. – Rup Aug 7 '14 at 10:35
  • mind the capital X: chmod -R a-x *; chmod -R a+X * first remove execute permissions everywhere, then enables it in dirs only. – commonpike Aug 7 '14 at 13:34
chgrp www-data .htaccess
chmod a-wx .htaccess

WordPress needs to write rules to .htaccess at some point, usually to do with how a URL is seen and re-written. www-data group may need write access.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.