I'm writing a script to automatically check file permissions in all wordpress installations on a server.
This document https://wordpress.org/support/article/hardening-wordpress/ is unclear on a certain point:
User-supplied content: intended to be writable by your user account and the web server process. Within /wp-content/ you will find:
Theme files. If you want to use the built-in theme editor, all files need to be writable by the web server process. If you do not want to use the built-in theme editor, all files can be writable only by your user account.
Plugin files: all files should be writable only by your user account.
Is that documentation above correct and complete (in all contexts) - can I trust it ?
If so, what does it say:
- is only the directory wp-content itself writable for both user and webserver, or
- is anything inside wp-content writable for both, except plugins and optionally themes ?
I think it says the first .. but the uploads folder isnt mentioned, and that should be writable by the webserver, for sure ?
EDIT: slightly rephrased the question