0

I recently installed wordpress on vps. All theme files' permission are set to 644. The ownership is already given to root. But still wordpress admin can't seem to find "Update file" button in file editor unless I set permissions to 777. Isn't wordpress admin considered as root?

I'm on Centos 6. Also tried follow commands but nothing happened

sudo usermod -aG root $USER
sudo chown -R root:root /var/www/html

What do I do?

screenshot of permissions

  • I consider this particular feature to be a highly dangerous one. It's one of the most common ways WordPress sites get compromised. – ceejayoz Jun 4 '16 at 12:54
  • Should create non-root user and give him permission and revoke root user permissions? – wp student Jun 4 '16 at 13:04
2

You had better hope that WP isn't running as root. :)

You're confusing Wordpress users and system users. They're two completely different things. To grant WP the ability to write files, you need to grant that access to the user that your web application is running as. You are running CentOS, and IIRC web services run as the "nobody" user, though I cannot verify that at this moment.

  • Centos + nginx + php-fpm + fastcgi... I'm not confusing Wordpress user with system user. I considered that Wordpress admin will be able to perform this basic thing. I installed via vultr oneclick-application. – wp student Jun 4 '16 at 12:36
  • Well, all you need to do is sort out what user things are running as, and then grant that user appropriate permissions. – EEAA Jun 4 '16 at 12:38
0

Here's the script I run that sets permissions for all my Wordpress installs. I have more information in my wordpress nginx tutorial here, and the information is based on the official wordpress codex.

chown -R tim:www-data *
find /var/www/wp -type d -exec chmod 755 {} \;
find /var/www/wp -type f -exec chmod 644 {} \;
find /var/www/wp/wp-content/uploads -type f -exec chmod 664 {} \;
find /var/www/wp/wp-content/plugins -type f -exec chmod 664 {} \;
find /var/www/wp/wp-content/themes -type f -exec chmod 644 {} \;
chmod 440 /var/www/wp/wp-config.php
chmod -R g+s /var/www/wp/

Nginx runs as www-data, I think PHP does as well (can't remember but my article will say).

0

The Wordpress admin users can not modify any files that cannot be modified by the web server that is running it. A secure site will lock down all PHP files so that they can not be modified by the web serve. It appears you have done this. You probably should have set the group to www (directory may be wrong for your installation):

chown root:www  /var/www/html/wp-content

When editing a theme, you should consider creating a new theme based off an existing theme. This will prevent security updates from wiping out your changes. Temporarily grant access to the wp-content/themes directory to the web server. If the group is set correctly, you can do this with the command sudo chmod 775 wp-content/themes run from the directory containing your wp-content directory.

Check the Wordpress Codex site for more details.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.