Permissions on WordPress files as well as security best practices

Hello lbon,

to install updates/plugins without ftp you should add the following line to your wp-config.php:

define(‘FS_METHOD’,’direct’);

somewhere where other define() are written as well.

For security best practices read: http://codex.wordpress.org/Hardening_WordPress
I have written a plugin that can help you identify violations of the security best practices, you can give it a try (MVIS Security Center).

Stefan

Hello Lars,

Are you on a shared host or is it your own box?
Normally, you will have a dedicated (linux) user account and the group ownership belongs to the webserver. When only allowing your dedicated user has write permissions then no other user on the shared host that uses the same webserver group can write your files.

Let me know if this helped to clarify, or if you have any other questions.

Stefan

Have you reviewed Hardening_WordPress?

Hello Lars,

in this case things will be considerably easier for you, because you got the power 🙂
Add another user that owns all files and give the webserver user read and execute permissions for the group. This way, if someone were to hack you they would only be getting the rights of the webserver user (which can only read files) and

so basically let’s say your user is called lars and your webserver is called www-data then you might want to do:
chown -R lars /var/www/wordpress/
chgrp -R www-data /var/www/wordpress/
chmod -R 750 /var/www/wordpress/ (assuming wordpress is installed in that directory.
This gives your user “lars” full permissions, your webserver all necessary permissions to make WordPress function properly.

If you have problems with automatic updating read this passage here: http://codex.wordpress.org/Hardening_WordPress#Regarding_Automatic_Updates

Stefan