Wrong permissions when uploading a file through WordPress | IIS

Question

I own an IIS server where I have hosted a simple WordPress website. I have made this website available to the internet over port 80.

Almost everything is working fine, except the permissions that are set on files I upload to WordPress using the CMS itself.

The IUSR, IIS_IUSRS and Network Service users have Full Control over the entire WordPress directory, however, when I upload new files, the permissions aren't inherited.

Basically WordPress generates a thumbnail, which I can access. But when I try to select the actual uploaded image, the image is not recognized. When I go to my directory on the IIS server, I see that the user accounts mentioned above don't have permissions on this new image at all. When I inherit the permissions again, I am able to select the image again.

I've looked all over the internet and tried solutions like changing the owner of the WordPress directory and changing the Anonymous Authentication user account, but unfortunately nothing is working.

Does anybody of you have any suggestions?

Answer 1

I found that IIS DOES now include INDEX.PHP and that the solution was to modify the location and permissions of the WordPress uploads folder. https://www.urtech.ca/2018/04/solved-500-error-on-downloads-in-wordpress-running-on-iis/

I hope this helps.

Answer 2

I had this exact same problem. It turns out WordPress is using the C:\Windows\Temp directory. When I changed the permissions to this directory for IIS_USRS to have read permission, the issue was resolved.

There may be similar or slightly different reasons as to why you have image upload problems. If so, read this small article. It might have something else for you to try.

https://www.computerworld.com/article/2833144/wordpress-on-iis---the-uploaded-file-could-not-be-moved--solved-.html

Answer 3

IIS does not by default add index.php to the list of accept default documents. IIS will also not allow for directory browsing. This is critical for Wordpress to run correctly. To solve this, locate the web.config file in the root of the hosting space. If it does not exist, create one and add the following commands.

<?xml version="1.0" encoding="UTF-8"?>
 <configuration>
  <system.webServer>
  <directoryBrowse enabled="false"/>
  <defaultDocument>
  <files>
    <clear/>
    <add value="index.php"/>
    <add value="Default.htm"/>
    <add value="Default.asp"/>
    <add value="index.htm"/>
    <add value="Default.aspx"/>
  </files>
</defaultDocument>
<rewrite>
  <rules>
    <rule name="wordpress" patternSyntax="Wildcard">
      <match url="*"/>
        <conditions>
          <add input="{REQUEST_FILENAME}" matchType="IsFile" negate="true"/>
          <add input="{REQUEST_FILENAME}" matchType="IsDirectory" negate="true"/>
        </conditions>
      <action type="Rewrite" url="index.php"/>
    </rule>
  </rules>
</rewrite>
</system.webServer>
</configuration>

Answer 4

1. Make sure to use the following permissions for the directory of your website.

• CREATOR OWNER – special permissions.
• SYSTEM – Full Control.
• Administrators – Full Control.
• Users – Full Control.
• IIS APPPOOL<the name of your application pool> (if any) – full control

2. Go to your website -> IIS Authentication -> Anonymous Authentication (which should be the only one enabled). Click Edit. Ensure Application pool identity is selected.

3. Restart the application on IIS.

That is it!