Topics

  • Permission Modes
    • Case Permission Modes
  • Permission Scheme for WordPress
    • Shared Hosting with suexec
  • Using an FTP Customer
    • Unhide the subconscious files
  • Using the Command Line
    • Nigh Chmod
  • The dangers of 777
    • The Worst Upshot
    • Detect a Workaround
  • Finding Secure File Permissions
    • Instance Permission Settings
      • .htaccess permissions
      • php.ini permissions
      • php.cgi permissions
      • php5.cgi permissions
    • SELinux
      • How to make up one's mind if selinux is the trouble?
    • See As well

On reckoner file systems, different files and directories havepermissions that specify who and what can read, write, modify and admission them. This is important because WordPress may need access to write to files in yourwp-content directory to enable sure functions.

Permission Modes

                  7       5    five  user   group  earth  r+westward+x  r+x    r+10  four+two+1  4+0+1  4+0+1 = 755

The permission manner is computed past calculation up the following values for the user, the file group, and for everyone else. The diagram shows how.

  • Read iv – Allowed to read files
  • Due westrite two – Allowed to write/alter files
  • eXecute1 – Read/write/delete/modify/directory
                  7       4     iv  user   group  world  r+w+x    r      r  four+two+ane  4+0+0 4+0+0  = 744

Height ↑

Example Permission Modes

Mode Str Perms Explanation
0477 -r–rwxrwx owner has read just (4), other and group has rwx (7)
0677 -rw-rwxrwx owner has rw just(6), other and group has rwx (vii)
0444 -r–r–r– all have read but (4)
0666 -rw-rw-rw- all accept rw only (6)
0400 -r——– owner has read simply(4), group and others have no permission(0)
0600 -rw——- possessor has rw only, group and others have no permission
0470 -r–rwx— owner has read simply, group has rwx, others have no permission
0407 -r—–rwx possessor has read simply, other has rwx, group has no permission
0670 -rw-rwx— owner has rw simply, group has rwx, others have no permission
0607 -rw—-rwx possessor has rw only, group has no permission and others have rwx

Top ↑

Permission Scheme for WordPress

Permissions volition exist dissimilar from host to host, and then this guide simply details general principles. It cannot cover all cases. This guide applies to servers running a standard setup (notation, for shared hosting using "suexec" methods, see beneath).

Typically, all files should be endemic by your user (ftp) account on your web server, and should be writable by that business relationship. On shared hosts, files should never be endemic by the webserver process itself (sometimes this isworld wide web, orapache, ornobody user).

Any file that needs write access from WordPress should exist owned or group-owned past the user account used by WordPress (which may exist different than the server account). For instance, yous may take a user account that lets you lot FTP files back and forth to your server, merely your server itself may run using a split up user, in a divide usergroup, such asdhapache ornobody. If WordPress is running as the FTP business relationship, that account needs to accept write access, i.e., be the possessor of the files, or vest to a group that has write access. In the latter case, that would mean permissions are set more permissively than default (for example, 775 rather than 755 for folders, and 664 instead of 644).

The file and folder permissions of WordPress should be the same for most users, depending on the blazon of installation you lot performed and the umask settings of your system environment at the fourth dimension of install.

NOTE: If an experienced user installed WordPress for y'all, yous likely do non demand to modify file permissions. Unless you are experiencing bug with permission errors, or youwant to, you probably should not mess with this.

Annotation: If you installed WordPress yourself, you probable Practice need to alter file permissions. Some files and directories should exist "hardened" with stricter permissions, specifically, the wp-config.php file. This file is initially created with 644 permissions, and information technology's a hazard to leave it like that. See Security and Hardening.

Typically, all core WordPress files should be writable only by your user business relationship (or the httpd business relationship, if unlike). (Sometimes though, multiple ftp accounts are used to manage an install, and if all ftp users are known and trusted, i.east., not a shared host, then assigning grouping writable may exist appropriate. Enquire your server admin for more info.) However, if yous utilize mod_rewrite Permalinks or other .htaccess features you should make certain that WordPress can also write to your/.htaccess file.

If you want to use the built-in theme editor, all files demand to exist grouping writable. Try using it earlier modifying file permissions, it should work. (This may be true if different users uploaded the WordPress packet and the Plugin or Theme. This wouldn't be a problem for Plugin and Themes installed via the admin. When uploading files with different ftp users group writable is needed. On shared hosting, brand sure the grouping is exclusive to users yous trust… the apache user shouldn't exist in the group and shouldn't own files.)

Some plugins crave the /wp-content/ folder be made writeable, but in such cases they volition permit you know during installation. In some cases, this may crave assigning 755 permissions. The same is true for/wp-content/cache/ and perhaps/wp-content/uploads/ (if you lot're using MultiSite you may also need to do this for/wp-content/blogs.dir/)

Additional directories under /wp-content/ should be documented by any plugin / theme requires them. Permissions will vary.

/    |- index.php |- wp-admin |   `- wp-admin.css |- wp-weblog-header.php |- wp-comments-postal service.php |- wp-commentsrss2.php |- wp-config.php |- wp-content |   |- cache |   |- plugins |   |- themes |   `- uploads |- wp-cron.php |- wp-includes `- xmlrpc.php

Top ↑

Shared Hosting with suexec

The above may not apply to shared hosting systems that use the "suexec" arroyo for running PHP binaries. This is a pop arroyo used by many web hosts. For these systems, the php process runs equally the owner of the php files themselves, allowing for a simpler configuration and a more secure environment for the specific case of shared hosting.

Note: suexec methods should NEVER exist used on a unmarried-site server configuration, they are more than secureonly for the specific case of shared hosting.

In such an suexec configuration, the correct permissions scheme is simple to empathise.

  • All files should be owned past the actual user'south business relationship, not the user account used for the httpd process.
  • Group ownership is irrelevant, unless at that place'southward specific group requirements for the spider web-server process permissions checking. This is non usually the case.
  • All directories should be 755 or 750.
  • All files should be 644 or 640. Exception: wp-config.php should exist 440 or 400 to preclude other users on the server from reading information technology.
  • No directories should e'er be given 777, even upload directories. Since the php process is running as the owner of the files, information technology gets the owners permissions and tin write to even a 755 directory.

In this specific type setup, WordPress will discover that it can directly create files with the proper ownership, so it will non ask for FTP credentials when upgrading or installing plugins.

Pop methods used by sysadmins for this setup are:

  • suPHP, runs through php-cgi, currently unmaintained since 2013.
  • mod_ruid2, apache module, currently unmaintained since 2013.
  • mpm-itk, apache module.
  • mod_fcgid, an Apache module and FastCGI server with more than extensive configuration.
  • PHP-FPM, an alternative FastCGI server with shared OPCode, for utilize with Apache and Nginx.

Top ↑

Using an FTP Client

FTP programs ("clients") allow you to set permissions for files and directories on your remote host. This function is ofttimes calledchmod orset permissions in the plan menu.

In WordPress install, two files that yous will probably want to alter are the index folio, and the css which controls the layout. Here's how yous change index.php –the process is the same for any file.

In the screenshot below, look at the terminal column – that shows the permissions. It looks a bit disruptive, but for now but annotation the sequence of letters.

Initial permissions

Right-click 'index.php' and select 'File Permissions'
A popup screen will appear.

Altering file permissions

Don't worry well-nigh the bank check boxes. Just delete the 'Numeric value:' and enter the number you need – in this case it's 666. Then click OK.

Permissions take been altered.

You tin can now run into that the file permissions accept been inverse.

Elevation ↑

Unhide the hidden files

By default, most FTP Clients, including FileZilla, go along subconscious files, those files first with a menstruation (.), from being displayed. But, at some point, yous may need to see your subconscious files so that you can change the permissions on that file. For instance, you may need to make your .htaccess file, the file that controls permalinks, writeable.

To display hidden files in FileZilla, in it is necessary to select 'View' from the summit menu, then select 'Show hidden files'. The screen display of files will refresh and any previously hidden file should come into view.

To get FileZilla to always show hidden files – under Edit, Settings, Remote File Listing, check the Always evidence hidden files box.

In the latest version of Filezilla, the 'Show subconscious files' selection was moved to the 'Server' tab. Select 'Force prove hidden files.'

Tiptop ↑

Using the Command Line

If you have vanquish/SSH access to your hosting business relationship, yous can usechmod to modify file permissions, which is the preferred method for experienced users. Before you commencement usingchmod it would be recommended to read some tutorials to make sure you understand what you can achieve with information technology. Setting wrong permissions tin can accept your site offline, then please have your time.

  • Unix Permissions

You tin makeall the files in yourwp-content directory writable in two steps, but before making every single file and folder writable you should beginning try safer alternatives like modifying only the directory. Try each of these commands commencement and if they don't work then get recursive, which will make even your themes image files writable. Replace DIR with the folder yous want to write in

chmod -v 746 DIR chmod -v 747 DIR chmod -five 756 DIR chmod -v 757 DIR chmod -v 764 DIR chmod -v 765 DIR chmod -v 766 DIR chmod -v 767 DIR

If those fail to allow you to write, attempt them all once more in lodge, except this time supersede -five with -R, which will recursively change each file located in the folder. If after that you lot still deceit write, you may now endeavor 777.

Height ↑

About Chmod

chmod is a unix command that means "changemoderne" on a file. The-R flag means to apply the change to every file and directory within ofwp-content. 766 is the manner we are changing the directory to, it ways that the directory is readable and writable by WordPress and any and all other users on your system. Finally, we have the proper name of the directory nosotros are going to modify,wp-content. If 766 doesn't work, you tin can attempt 777, which makes all files and folders readable, writable, and executable by all users, groups, and processes.

If you use Permalinks you should besides modify permissions of .htaccess to make certain that WordPress tin update information technology when y'all change settings such as adding a new page, redirect, category, etc.. which requires updating the .htaccess file when mod_rewrite Permalinks are beingness used.

  1. Go to the chief directory of WordPress
  2. Enterchmod -five 666 .htaccess

NOTE: From a security standpoint, fifty-fifty a small amount of protection is preferable to a world-writeable directory. Get-go with depression permissive settings like 744, working your way upwards until it works. Only utilize 777 if necessary, and hopefully but for a temporary amount of fourth dimension.

Top ↑

The dangers of 777

The crux of this permission issue is how your server is configured. The username you use to FTP or SSH into your server is almost likely not the username used past the server awarding itself to serve pages.

                  seven      7      vii  user   grouping  world  r+w+x  r+west+x  r+west+x  4+2+1  iv+ii+1  4+2+1  = 777

Frequently the Apache server is 'owned' past thewww-information,dhapache ornobody user accounts. These accounts take a limited amount of access to files on the server, for a very adept reason. By setting your personal files and folders owned by your user account to be World-Writable, yous are literally making them Globe Writable. Now the world wide web-information, dhapache and nobody users that run your server, serving pages, executing php interpreters, etc. volition have full access to your user account files.

This provides an avenue for someone to gain admission to your files by hijacking basically whatsoever process on your server, this also includes any other users on your automobile. So you should call up carefully about modifying permissions on your machine. I've never come across anything that needed more than 767, and then when y'all see 777 enquire why information technology's necessary.

Top ↑

The Worst Upshot

The worst that tin can happen as a consequence of using 777 permissions on a binder or even a file, is that if a malicious cracker or entity is able to upload a stray file or modify a current file to execute code, they will have complete control over your blog, including having your database information and password.

Peak ↑

Find a Workaround

It is usually pretty easy to have the enhanced features provided by the impressive WordPress plugins available, without having to put yourself at risk. Contact the Plugin writer or your server back up and request a workaround.

Meridian ↑

Finding Secure File Permissions

The .htaccess file is one of the files that is accessed by the owner of the procedure running the server. So if yous gear up the permissions too low, then your server won't exist able to access the file and will cause an error. Therein lies the method to find the most secure settings. Start also restrictive and increase the permissions until it works.

Top ↑

Example Permission Settings

The following example has acustom compiled php-cgi binary and acustom php.ini file located in the cgi-bin directory for executing php scripts. To prevent the interpreter and php.ini file from being accessed directly in a spider web browser they are protected with a .htaccess file.

Default Permissions (umask 022)

644 -rw-r--r--  /dwelling house/user/wp-config.php 644 -rw-r--r--  /habitation/user/cgi-bin/.htaccess 644 -rw-r--r--  /home/user/cgi-bin/php.ini 755 -rwxr-xr-10  /home/user/cgi-bin/php.cgi 755 -rwxr-xr-x  /dwelling/user/cgi-bin/php5.cgi

Secured Permissions

600 -rw-------  /dwelling house/user/wp-config.php half dozen04 -rw----r--  /home/user/cgi-bin/.htaccess 600                  -rw-------  /home/user/cgi-bin/php.ini 711                  -rwx--10--ten  /home/user/cgi-bin/php.cgi                  100                  ---x------  /abode/user/cgi-bin/php5.cgi

Top ↑

.htaccess permissions

644 > 604 – The bit allowing the group owner of the .htaccess file read permission was removed. 644 is commonly required and recommended for .htaccess files.

Tiptop ↑

php.ini permissions

644 > 600 – Previously all groups and all users with admission to the server could admission the php.ini, even by just requesting information technology from the site. The tricky thing is that because the php.ini file is only used past the php.cgi, we only needed to brand sure the php.cgi process had admission. The php.cgi runs as the same user that owns both files, so that unmarried user is now the merely user able to access this file.

Pinnacle ↑

php.cgi permissions

755 > 711 This file is a compiled php-cgi binary used instead of mod_php or the default vanilla php provided past the hosting company. The default permissions for this file are 755.

Top ↑

php5.cgi permissions

755 > 100 – Because of the setup where the user account is the possessor of the process running the php cgi, no other user or group needs access, so we disable all admission except execution access. This is interesting because it really works. You can endeavor reading the file, writing to the file, etc. merely the only access yous take to this file is to run php scripts. And as the owner of the file you can always modify the permission modes dorsum once more.

$ cat: php5.cgi: Permission denied ./php5.cgi:  Welcome

Meridian ↑

SELinux

Security Enhanced linux is a kernel security module that provides mechanisms past which processes can exist sandboxed into particular contexts. This is of particular use to limit the actions that spider web pages can perform on other parts of the operating system. Actions that are denied by the security policy are often hard to distinguish from regular file permission errors.

selinux is typically installed on Redhat family distributions (e.g., CentOS, Fedora, Scientific, Amazon and others).

Top ↑

How to make up one's mind if selinux is the problem?

If you are on a debian based distribution, you are probably fine.

Run the following command (on rpm based systems);

# rpm -qa | grep selinux selinux-policy-targeted-3.xiii.1-166.el7_4.7.noarch selinux-policy-3.thirteen.1-166.el7_4.seven.noarch libselinux-2.v-11.el7.x86_64 libselinux-python-2.5-11.el7.x86_64 libselinux-utils-2.5-eleven.el7.x86_64

and to check whether it is the crusade of denials of permissions:

# getenforce Enforcing

I result that selinux causes is blocking the wp-admin tools from writing out the `.htaccess` file that is required for url rewriting. There are several commands for inspecting this behaviour

# audit2allow -w -a type=AVC msg=audit(1517275570.388:55362): avc:  denied  { write } for  pid=11831 comm="httpd" path="/var/www/case.org/.htaccess" dev="vda1" ino=67137959 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:httpd_sys_content_t:s0 tclass=file         Was acquired by:         The boolean httpd_unified was set incorrectly.         Description:         Allow httpd to unified          Allow admission past executing:         # setsebool -P httpd_unified 1

and

# ausearch -grand avc -c httpd ---- time->Tue Jan 30 01:xxx:31 2018 blazon=PROCTITLE msg=audit(1517275831.762:55364): proctitle=2F7573722F7362696E2F6874747064002D44464F524547524F554E44 type=SYSCALL msg=audit(1517275831.762:55364): curvation=c000003e syscall=21 success=no exit=-13 a0=55b9c795d268 a1=2 a2=0 a3=i items=0 ppid=11826 pid=11829 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 primal=(null) type=AVC msg=audit(1517275831.762:55364): avc:  denied  { write } for  pid=11829 comm="httpd" name="bioactivator.org" dev="vda1" ino=67137958 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:httpd_sys_content_t:s0 tclass=dir ----


You can temporarily disable selinux to decide if it is the cause of the problems;

# setenforce usage:  setenforce [ Enforcing | Permissive | i | 0 ]

Height ↑

See Likewise

  • Support Forum thread
  • htaccess for subdirectories
  • Override WordPress Default permissions