WordPress: Fixing file permissions

01-overview.md

Overview

All files should be owned by your user account, and should be writable by you. Any file that needs write access from WordPress should be writable by the web server, if your hosting set up requires it, that may mean those files need to be group-owned by the user account used by the web server process.

/

The root WordPress directory: all files should be writable only by your user account, except .htaccess if you want WordPress to automatically generate rewrite rules for you.

/wp-admin/

The WordPress administration area: all files should be writable only by your user account.

/wp-includes/

The bulk of WordPress application logic: all files should be writable only by your user account.

/wp-content/

User-supplied content: intended to be writable by your user account and the web server process.

/wp-content/themes/

Theme files. If you want to use the built-in theme editor, all files need to be writable by the web server process. If you do not want to use the built-in theme editor, all files can be writable only by your user account.

/wp-content/plugins/

Plugin files: all files should be writable only by your user account.

Other directories that may be present with /wp-content/ should be documented by whichever plugin or theme requires them. Permissions may vary.

02-fixing-file-permissions.md

Fixing file permissions

Here is the correct file permissions for Wordpress: To set correct permissions you need to use these commands:

sudo chown www-data:www-data -R *          # Let apache be owner
sudo find . -type d -exec chmod 755 {} \;  # Change directory permissions rwxr-xr-x
sudo find . -type f -exec chmod 644 {} \;  # Change file permissions rw-r--r--
sudo chmod 0666 -v .htaccess               # Change .htaccess permissions to -rw-rw-rw-
sudo chmod 0755 -Rv wp-content/            # Change "wp-content" folder permissions to drwxrw-rw-

Depending on your server configuration you may put your wp-content on 775. This permission will allow your group to write in this folder. Why add group permissions? Because in wordpress, you can have two users working on files, the www-data user (who executes the website) and the ftp user (who downloads plugins and updates from the webplatform wordpress). You can put your wp-content on 755 but you have to make www-data the owner of this folder and do your updates manually via FTP. http://codex.wordpress.org/Hardening_WordPress

Or use it on wp-config.php

putenv('TMPDIR=' . ini_get('upload_tmp_dir'));
define('FS_CHMOD_DIR', (0755 & ~ umask()));
define('FS_CHMOD_FILE', (0644 & ~ umask()));

03-fixing-ftp-permission.md

Fixing FTP request permission

To fix FTP file permission, go to your web server httpd.conf file and change user and group to the correct user that manages files in your web server, usually www-data:

<IfModule unixd_module>
#
# If you wish httpd to run as a different user or group, you must run
# httpd as root initially and it will switch.  
#
# User/Group: The name (or #number) of the user/group to run httpd as.
# It is usually good practice to create a dedicated user and group for
# running httpd, as with most system services.
#
User www-data
Group www-data
</IfModule>