Hardening wordpress: wp-content file permissions?

Question

I'm writing a script to automatically check file permissions in all wordpress installations on a server.

This document https://wordpress.org/support/article/hardening-wordpress/ is unclear on a certain point:

/wp-content/

User-supplied content: intended to be writable by your user account and the web server process. Within /wp-content/ you will find:

/wp-content/themes/

Theme files. If you want to use the built-in theme editor, all files need to be writable by the web server process. If you do not want to use the built-in theme editor, all files can be writable only by your user account.

/wp-content/plugins/

Plugin files: all files should be writable only by your user account.

Is that documentation above correct and complete (in all contexts) - can I trust it ?

If so, what does it say:

• is only the directory wp-content itself writable for both user and webserver, or
• is anything inside wp-content writable for both, except plugins and optionally themes ?

I think it says the first .. but the uploads folder isnt mentioned, and that should be writable by the webserver, for sure ?

EDIT: slightly rephrased the question

Answer 1

There are several sides to this. What it should be ideally, what is is practically, and what it usually has to be practically.

There are two contexts to the writing files in WordPress.

Just do it with PHP

The locked down hardest scenario here is that only uploads is writable. Otherwise core functionality will start to break down.

However plugins might play loose with it and assume all of wp-content to be writable.

Filesystem API

This is proper way to do writes, but it's also hard on end–user since it asks for FTP credentials if that's what it takes it.

This needs to be able to write everything, or (again) core functionality breaks down and in larger ways (updates, etc).

So to sum it up:

1. Only uploads should be writable via PHP
2. If rest of content folder isn't writable third party code might fail
3. Filesystem API should be able to do whatever, unless you want to lock it down hard to the point of read–only filesystem from WP perspective (some setups do work like that)

Answer 2

What would be wrong with this ?

# you own everything
chown -R [user].[user] * .htaccess

# others and group may not write anywhere
chmod -R og-w *

# execute permissions on dirs only
chmod -R a-x *
chmod -R a+X *

# webserver co-owns htaccess
chgrp www-data .htaccess
chmod a-wx .htaccess
chmod u+w .htaccess

# webserver co-owns wp-content and below
chgrp -R www-data wp-content

# webserver may write in wp-content itself
chmod g+w wp-content


# webserver may write in and below uploads
chmod -R g+w wp-content/uploads


# ------------
# custom exceptions below this
# ------------

# webserver may write in htaccess (optional)
# chmod g+w .htaccess

# webserver may write in and below themes (optional)
# chmod -R g+w wp-content/themes

Answer 3

chgrp www-data .htaccess
chmod a-wx .htaccess

WordPress needs to write rules to .htaccess at some point, usually to do with how a URL is seen and re-written. www-data group may need write access.