correct permissions settings ?

We always set our wp-content folder to chmod 755.

Try 755, but for some reason, some servers cause a failure when uploading. If you change to 755 and all is well, keep it, otherwise you may need 777.

i can see my upload folder from the web which i dont want people to see. is that right ?

Yes and no. It needs to be accessible to everyone on the web in order to serve content. It’s contents are only viewable because you aren’t restricting casual directory browsing with “Options -Indexes” in your .htaccess.

thanks, 777 should never be done under any circumstances cos that is like spreading your legs for the polish hackers.

I think that could be a fairly misrepresentative statement all the way around.

You may also want to be aware of permissions in a shared server environment. You could be more susceptible to poisoning from compromised accounts on your own server than from the web if shared server user permissions aren’t correct. Correct file ownership is just as important.

Well, good for you, knowin’ and showin’ us all of that “hacky” stuff! Sounds like you got it pretty well covered!

i can see my upload folder from the web which i dont want people to see. is that right ?

Did I mention you overlooked preventing casual browsing of your directories by simply placing Options -Indexes in your .htaccess file?

🙂

i did work as a penetration tester once, but i was crap and they fired me, so that shows how good i am

I can honestly say I probably would have never guessed that.

directory listing doesnt stop the file being accessible if you know where it is though does it ?

I’ve always thought that could actually be sort of a convenience, if you find yourself in a position where you might want a web browser to display those resources to others.

recursive chmodding the uploads folder

How does that work? What’s the “recursive” thing mean?

your downloadable files which people are supposed to buy would be free, assuming you knew the file name.

You mean people could just download my photos and stuff that I have for sale without even paying for it!?

I guess I must tend to be a little more linear – admittedly even downright myopic sometimes </irony> – in my thinking.

After a fresh install my normal M.O. is to cd to the web root and chmod my wordpess directory to 0750, Then I’ll chown -R [username]:[serveracct] the entire directory. Then I’ll hop right inside the directory itself and run;

find . -type f -exec chmod 644 {} \;

find . -type d -exec chmod 755 {} \;

…against the newly uploaded contents.

That ensures from the onset of a new installation that all of my files and directories are owned by my user account and group owned by the account the server runs under. The next step (for me) is to immediately upload an image to the media library. This usually means temporarily making /wp-content writable so wordpress can create the uploads directory for me. Once the upload directory is created, I chmod /wp-content back to 0755. From that point forward (if I remember correctly), I believe the most relaxed the permissions on the upload (and upload/sub-directories, when I use them), directory has ever been is 0775. I guess there might be an upload directory or two at 0777, but I don’t have any reason to worry about it. Every other directory is 0755, and files are all 644 on the norm. (permissions in shared environments may vary here and there)

not sure if thats sarcastic or not 🙂

I might truly feel hurt by that sentiment, if I didn’t already think that you were probably the type of guy who isn’t afraid to say what-ever he wants to who-ever he wants, ignore who-ever isn’t relevant to your own interests, and only show respect to people who have earned it! But yeah… You’re just preachin’ to the choir, mate.

I’ve been jammin’ ‘ya all along. But no worries! It doesn’t mean I can’t learn something from you, or that I don’t respect your opinions!!

Best wishes!

🙂

what does jamming mean ? having me on ?

Yes. Sorry about that.. It’s a compulsive response to certain social stimuli for me sometimes. My apologies.

ive been thrown off of practically every forum ive ever been on for swearing

Well, I am a firm believer in upholding longstanding tradition, so if there’s anything I can do to help you out with that, let me know!

its great, im awesome!

You remind me of a young fella’ I taught a handful of speed riffs to a few years back. In his mind, he always heard himself shredding like Paul Gilbert, while in reality, everyone else in the room just heard him chopping away like Paul Bunyan. Ahhhh, now you’ve gone and made me nostalgic. Time to dust off the old Strat and and see if the mains in the DeVille will still light.

Off to find a pint or two. See ‘ya.