I think that would mean anything following ‘/wp-content/themes/’, but I do not know what actual settings are required. At my own sites where I can edit at-will and never have any trouble with intrusion, my /wp-content/ folder is set at 0705, then the /themes/ folder and all theme folders are 0755 with 0644 for files. And then along with that, I have this in the /themes/ folder (as well as in /plugins/ and /uploads/) as index.php with its own permissions set at 0404:
<?php
// in-/wp-content/-n-/plugins/-n-/themes/n-/uploads/
// Permissions: 0404 //
exit;?>
Moderator
t-p
(@t-p)
The WordPress Dashboard by default allows administrators to edit PHP files, such as plugin and theme files. If you are really concerned about security, disable it by placing this line in wp-config.php:
define('DISALLOW_FILE_EDIT', true);
Also review this:
https://codex.wordpress.org/Changing_File_Permissions
I’m concerned about security to the extent that everyone is, but I’m not paranoid about it. I’m just trying to find out what the recommended set up is. I had actually read that document, Tara, and it seemed to me to contradict the one I linked to. It contains this:
Typically, all files should be owned by your user (ftp) account on your web server, and should be writable by that account. On shared hosts, files should never be owned by the webserver process itself (sometimes this is www, or apache, or nobody user)
The Hardening WordPress document talks about giving write permissions to the themes directory. I took that to mean that it should be owned by some user and have group write permissions to the apache process. Something like this:
chown -R themes fred:www-data
chmod -R 775 themes
Moderator
t-p
(@t-p)
Generally this what I use: 755 for folders and 644 for files.
Also, I keep the default file editor in the dashboard disabled.
Yes, I think I’ll go with that. I tried following the advice in Hardening WordPress but ran into permissions problems with media uploads and plugin installations.
Most people in this Stack Exchange thread seem to be doing it that way. Although, interestingly enough, there are a couple of people who are adamant that that’s the wrong to do it, and they quote the Hardening WordPress document to support their assertions.
