1

I have just started out with a VPS running centos 6.3 to host my blog and play around. After Installing WordPress 3.5.1, when I tried to install some plugins from the admin console, it complained of the folders in wp-content (upgrades, plugins, themes ..) not being writable. I changed the owner and group of these folders to 'apache' which didn't work and then made the ftp user the owner which worked.

After this, I installed the BackWpup plugin which required the wp-content itself to be writable by 'apache' (owning by ftp user account did't work).

In the end I have folder permissions like below

[krishnaraj@myhost]$ pwd
/var/www/html/krishnaraj.mydomain.com/wp-content
[krishnaraj@myhost]$ ls -lrt
total 28
-rw-r--r-- 1 root   root                28 Feb  3 03:08 index.php
drwxr-xr-x 2 apache apache            4096 Feb  3 03:11 cache
drwxr-xr-x 4 apache apache            4096 Feb  3 06:52 uploads
drwxrwxr-x 5 myftpuser myftpuser      4096 Feb  3 07:22 themes
drwxrwxr-x 7 myftpuser myftpuser      4096 Feb  3 09:14 plugins
drwxrwxr-x 2 myftpuser myftpuser      4096 Feb  3 09:14 upgrade
drwxr-xr-x 2 apache apache            4096 Feb  3 09:32 backwpup-98372-logs
[krishnaraj@myhost wp-content]$

[krishnaraj@myhost]$ pwd           
/var/www/html/krishnaraj.mydomain.com
[krishnaraj@myhost]$ ls -lrt | grep wp-content 
drwxr-xr-x 8 apache apache  4096 Feb  3 09:32 wp-content
[krishnaraj@myhost]$

Are these permissions safe ? or should I be worrying about a security hole ?

5
  • The documentation should clear some doubts: Changing_File_Permissions
    – brasofilo
    Feb 3, 2013 at 18:52
  • @brasofilo Thanks for the link!. The article seems to suggest to change permissions as per the plugin needs and I think my settings shouldn't be a problem.
    – Krishnaraj
    Feb 3, 2013 at 19:50
  • Also as per codex.wordpress.org/Hardening_WordPress, think this is perfectly safe
    – Krishnaraj
    Feb 3, 2013 at 20:09
  • Would be great if you wrote an Answer with your findings ;)
    – brasofilo
    Feb 3, 2013 at 20:57
  • @brasofilo I actually did but the site said I had to wait 8 hrs :) .. I'll do it now :)
    – Krishnaraj
    Feb 4, 2013 at 10:19

1 Answer 1

2

As per the following from http://codex.wordpress.org/Hardening_WordPress#File_Permissions

/wp-content/
User-supplied content: intended to be completely writable by all users (owner/user, group, and public).

Within /wp-content/ you will find:

/wp-content/themes/
Theme files. If you want to use the built-in theme editor, all files need to be group writable. If you do not want to use the built-in theme editor, all files can be writable only by your user account.
/wp-content/plugins/
Plugin files: all files should be writable only by your user account.

my permissions should be perfectly fine.

This site is temporarily in read-only mode and not accepting new answers.

Not the answer you're looking for? Browse other questions tagged .