0

I have a wordpress install that I would like to tighten up the security on. I am reading the wordpress help page on hardening wordpress (https://wordpress.org/support/article/hardening-wordpress/#file-permissions) but I am not sure what is meant therein by

All files should be owned by your user account, and should be writable by you. Any file that needs write access from WordPress should be writable by the web server, if your hosting set up requires it, that may mean those files need to be group-owned by the user account used by the web server process.

The only access I have to the files on the server is by FTP, with which I can change the chmod numerical permissions (eg. 755, 644, etc) but I cannot affect the file owner or group.

Which is the quote referring to? Should I be able to change it via FTP? (im using filezilla at the moment)

1 Answer 1

2

»your user account« describes the system user of the remote host. Depending on the environment of your hosting provider, this is typically the same as the basic FTP account. In fact, it's a user on an operating system. So yes, you should be able to change it via FTP.

As there are typically many users working on one remote host, it's important to set the file permissions correctly. Rule of thumb: no one than you (your account) should have write permissions to any file or directory. Read-permissions should be granted to everyone, except for files with sensitive data (e.g. log files, database dumbs, all these could go with 600).

Why should everyone able to read files?

Assuming your provider configured apache as web server, the apache process runs under a separate system user (typically www-data). That means, to serve your content (attachments) to the world, the user www-data needs reading-permissions on these files. As your account and www-data normally doesn't share your default group, this means reading permissions to everyone (xx6, xx4).

And PHP files?

This depends on the PHP setup of your provider. If they configured PHP running in fast-CGI mode, the PHP interpreter runs normally with the privileges of your account. That means in theory, you could remove read-permissions of every php-file to anyone than you (600). But except for wp-config.php this doesn't really has any »hardening« benefit.

What is about wp-config/uploads?

If PHP runs in fCGI mode, default directory permissions (755) should totally be fine. If PHP runs as apache-module, it depends on the user/group management of your provider whether you need 775 or (in worst case) 777 for wp-content/uploads. If in doubt you should contact your provider and ask for the correct permissions.

Some words about these permissions:

File system permissions are handled with three classes: user, group and others and three independent permissions: execute, write and read.

Each file (or directory) is assigned to one user and one group. Here's an example: $ ls -la wp-config.php -rw-rw-r-- 1 david worker 1845 Jan 18 19:01 wp-config.php
This file wp-config.php belongs to the user david and the group worker. The symbolic notation of the files permission are read as:

  • user: rw (read & write) → 6
  • group: rw (read & write) → 6
  • others: r (read) → 4

In numeric notation that combines to 664. That means, user david is allowed to read and write the file, as he is the »owner« of the file. Any user which is in the group worker is also allowed to write to the file, as this is the group of the file. Anyone else (any user which is not david or in the group worker) is allowed to only read the file.

Some reference about file permissions: https://en.wikipedia.org/wiki/File_system_permissions

3
  • thanks for the info, I guess what I'm really asking is when you say 'system user' you mean the 'owner' permissions shown when I check the file permissions via FTP? (the only FTP account set up in my hosting panel) If so what then do Group Permissions relate to in terms of this article?
    – Toby
    Jan 20, 2016 at 13:03
  • To sum up, I think I mean: is there a difference between 'user permissions' and 'file permissions' in this case? Ta
    – Toby
    Jan 20, 2016 at 13:03
  • Well, user permissions are part of the file permissions. I extended my answer by a short explanation of the file permission system. Yes, owner permissions are the one of the user, that created the file (your system/ftp user). The meaning of group permissions depends on the permission management of your provider. Maybe you want to add an example on how the file permissions look like on your account (user, group, default permissions of file created by you).
    – David
    Jan 20, 2016 at 15:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.