0

I'm having problems with WordPress not be able to access files. When installing certain themes and plugins, it comes up with an error saying that it cannot create the directory. When I try to edit style.css it says that I need to make that file writable.

The file permissions were set to 644. It wouldn't work until I changed the settings to 777 or 776. WordPress was installed by our local ISP. Anyone got any ideas?

It seems that WordPress has not been setup properly. Is there anyway I can fix this without reinstalling the whole thing?

1
  • 1
    You might want to take this question to wordpress.stackexchange.com
    – Wesley
    Mar 13, 2011 at 5:42

1 Answer 1

1

The file permissions were set to 644. It wouldn't work until I changed the settings to 777 or 776. WordPress was installed by our local ISP.

Setting the permissions to 664 may not be enough in your environment.

A permission of 644 means that the user that owns the file/folder will have read/write permissions, the group that owns the file will have read permissions only, and any other users will have read only permissions. Very often Wordpress like most other web applications are running under Apache, and without special configuration, this means that Wordpress has the level of privileges that the Apache web server has. The user or group that Apache is using tends to be different for each distro/OS. On Debian/Ubuntu Apache runs as user/group = www-data/www-data. This means if your file has permissions of 644, and is not owned by www-data (or whatever user) then Apache will only have read access. How exactly you fix this depends on what level of access you have to the server, who else has access to the server, and how paranoid you are about security.

I suspect the most likely thing you need to do is either change the user-owner or group-owner of the file/files to the account used by Apache and change the permissions to 775/664. But you have to have enough privileges on the system to do this.

If the server isn't shared, or used to anything other then single instance of Apache, then just setting the permissions to 777/776 instead of 775/664 will not make a huge difference in security By giving Apache write access you have already given away most of the security. You have to be certain that anything Apache is running is secure. Whenever Apache has write access to a folder, that is a potential for a security issue. If your software has any bugs, then anyone on the Internet, can possibly manipulate those bugs to get Wordpress+Apache to write/change things in folders/files it has access to.

If you are using shared hosting you will want to lock things down a lot more. The exact details may be different depending on your shared host. If lots of people are sharing the same host, then I would be surprised if your ISP isn't using something like SUPHP or something else to assign a unique user for each virtual host. If they are, then you will want to make sure that you are setting the correct ownership based on what your ISP tells you.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .