Forum Moderators: rogerd & travelin cat

Message Too Old, No Replies

Correct Permissions for Wordpress Files in Ubuntu

Correct Permissions and Ownership for Wordpress Files in Ubuntu

         

elvang

1:58 pm on May 2, 2022 (gmt 0)

Top Contributors Of The Month



Hello everyone,
Not to have security issues and not to have any problem with updates, themes and plugins, are those permissions and ownerships right? My permissions and ownerships for wordpress are like:

total 228
drwxr-xr-x 5 www-data www-data 4096 May 2 13:41 .
drwxr-xr-x 6 www-data www-data 4096 Apr 22 11:41 ..
-rw-r--r-- 1 www-data www-data 523 Apr 22 13:25 .htaccess
-rw-r--r-- 1 www-data www-data 405 Feb 6 2020 index.php
-rw-r--r-- 1 www-data www-data 19915 Jan 1 03:15 license.txt
-rw-r--r-- 1 www-data www-data 7437 Dec 28 20:38 readme.html
-rw-r--r-- 1 www-data www-data 7165 Jan 21 2021 wp-activate.php
drwxr-xr-x 9 www-data www-data 4096 Apr 5 22:13 wp-admin
-rw-r--r-- 1 www-data www-data 351 Feb 6 2020 wp-blog-header.php
-rw-r--r-- 1 www-data www-data 2338 Nov 10 02:07 wp-comments-post.php
-r--r--r-- 1 www-data www-data 3352 May 2 13:41 wp-config.php
-rw-r--r-- 1 www-data www-data 3001 Dec 14 11:44 wp-config-sample.php
drwxr-xr-x 5 www-data www-data 4096 May 2 08:28 wp-content
-rw-r--r-- 1 www-data www-data 3939 Aug 3 2021 wp-cron.php
drwxr-xr-x 26 www-data www-data 12288 Apr 5 22:13 wp-includes
-rw-r--r-- 1 www-data www-data 2496 Feb 6 2020 wp-links-opml.php
-rw-r--r-- 1 www-data www-data 3900 May 15 2021 wp-load.php
-rw-r--r-- 1 www-data www-data 47916 Jan 4 11:30 wp-login.php
-rw-r--r-- 1 www-data www-data 8582 Sep 23 2021 wp-mail.php
-rw-r--r-- 1 www-data www-data 23025 Nov 30 20:32 wp-settings.php
-rw-r--r-- 1 www-data www-data 31959 Oct 25 2021 wp-signup.php
-rw-r--r-- 1 www-data www-data 4747 Oct 9 2020 wp-trackback.php
-rw-r--r-- 1 www-data www-data 3236 Jun 8 2020 xmlrpc.php

not2easy

5:41 pm on May 2, 2022 (gmt 0)

WebmasterWorld Administrator 10+ Year Member Top Contributors Of The Month



The letters have meaning and their positions in the column belong to different groups. 1st position is the file owner/account/server. 2nd position is "group" which would include files and people who are authorized. The 3rd position is "others" or public/everyone.

The meanings for the letters are as follows: r = read w=write/edit x=execute and d=directory.

So rw-r--r-- means that the server can read and write the file, the group of authorized files or people can read (only) and anyone can read it. If you scan down the third column in your list you will see that there are files you do not want the public to be able to read, and see if that file or directory is one that you wish everyone to access to read it.

For example, the permissions set for your wp-config.php file will allow any visitor to read it. That is not a very secure setting. It means that they are able to read your .sql username and password.

In your previous question: [webmasterworld.com...] I posted a link to the WP recommended settings and though they may be numeric rather than the lettering system for file permissions, that is the right place to learn what the best settings are. The wikipedia page for chmod can help you learn to convert numeric settings to alphabetic settings. The public would need to have rw access to post comments, use forms and to log in.

BTW - that "xmlrpc.php" file is to allow remote posting access and it is a common file that is attacked for vulnerabilities, just like the "wp-login.php" file. If you do not need remote posting capabilities it is best not to allow broad access to it.

elvang

9:53 pm on May 2, 2022 (gmt 0)

Top Contributors Of The Month



thank you @not2easy

phranque

10:00 pm on May 2, 2022 (gmt 0)

WebmasterWorld Administrator 10+ Year Member Top Contributors Of The Month



...numeric rather than the lettering system for file permissions...

fyi:
755 is equivalent to 'drwxr-xr-x'
644 is equivalent to '-rw-r--r--'

elvang

8:42 am on May 7, 2022 (gmt 0)

Top Contributors Of The Month



Hi @not2easy after reading wordpress instructions about file permissions and taking your advices into consideration i made some changes in file permissions ( especially i paid attention to .htaccess, wp-config, wp-login, xmlrpc.php) I am wondering what are your opinions about those important file permissions and the other files' permissions also.

drwxr-xr-x 5 www-data www-data 4096 May 2 13:41 .
drwxr-xr-x 6 www-data www-data 4096 Apr 22 11:41 ..
-rw------- 1 www-data www-data 523 Apr 22 13:25 .htaccess
-rw-r--r-- 1 www-data www-data 405 Feb 6 2020 index.php
-rw-r--r-- 1 www-data www-data 19915 Jan 1 03:15 license.txt
-rw-r--r-- 1 www-data www-data 7437 Dec 28 20:38 readme.html
-rw-r--r-- 1 www-data www-data 7165 Jan 21 2021 wp-activate.php
drwxr-xr-x 9 www-data www-data 4096 Apr 5 22:13 wp-admin
-rw-r--r-- 1 www-data www-data 351 Feb 6 2020 wp-blog-header.php
-rw-r--r-- 1 www-data www-data 2338 Nov 10 02:07 wp-comments-post.php
-rw------- 1 www-data www-data 3352 May 2 13:41 wp-config.php
-rw-r--r-- 1 www-data www-data 3001 Dec 14 11:44 wp-config-sample.php
drwxr-xr-x 6 www-data www-data 4096 May 4 06:38 wp-content
-rw-r--r-- 1 www-data www-data 3939 Aug 3 2021 wp-cron.php
drwxr-xr-x 26 www-data www-data 12288 Apr 5 22:13 wp-includes
-rw-r--r-- 1 www-data www-data 2496 Feb 6 2020 wp-links-opml.php
-rw-r--r-- 1 www-data www-data 3900 May 15 2021 wp-load.php
-rw------- 1 www-data www-data 47916 Jan 4 11:30 wp-login.php
-rw-r--r-- 1 www-data www-data 8582 Sep 23 2021 wp-mail.php
-rw-r--r-- 1 www-data www-data 23025 Nov 30 20:32 wp-settings.php
-rw-r--r-- 1 www-data www-data 31959 Oct 25 2021 wp-signup.php
-rw-r--r-- 1 www-data www-data 4747 Oct 9 2020 wp-trackback.php
-rw------- 1 www-data www-data 3236 Jun 8 2020 xmlrpc.php