blocks|key|178419|text|当您设置WP时，您(WP服务器)可能需要文件的写入权限。因此，访问权限可能需要松散。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|178420|chown+www-data:www-data++-R+*+#+Let+Apache+be+owner
find+.+-type+d+-exec+chmod+755+{}+\;++#+Change+directory+permissions+rwxr-xr-x
find+.+-type+f+-exec+chmod+644+{}+\;++#+Change+file+permissions+rw-r--r--|code-block|syntax|javascript|178421|+setup+you+应该+access+rights，根据Hardening+WordPress，除wp-content之外的所有文件都应该只能由您的用户帐户写入。可湿性粉剂的内容必须是由www-data也可写。|offset|length|style|BOLD|178422|chown+<username>:<username>++-R+*+#+Let+your+useraccount+be+owner
chown+www-data:www-data+wp-content+#+Let+apache+be+owner+of+wp-content|178423|也许您想稍后更改wp-content中的内容。在这种情况下，您可以|178424|使用ACLs.，|178425|临时将用户更改为www-data，|unordered-list-item|178426|授予wp-content组写入访问权限775，并加入组www-data或|178427|授予用户对文件夹的访问权限|178428|178429|无论您做什么，都要确保这些文件对www-data具有读写权限。|178430|entityMap|0|LINK|mutability|MUTABLE|url|https://wordpress.org/support/article/hardening-wordpress/|1|https://wiki.archlinux.org/index.php/Access_Control_Lists^0|0|0|0|A|B|2|U|J|0|0|0|0|2|4|1|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|1C|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|1D|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|1E|8|@$I|1F|J|1G|K|L]|$I|1H|J|1I|K|L]]|9|@$I|1J|J|1K|1|1L]]|A|$]]|$1|M|3|N|5|D|7|1M|8|@]|9|@]|A|$E|F]]|$1|O|3|P|5|6|7|1N|8|@]|9|@]|A|$]]|$1|Q|3|R|5|6|7|1O|8|@]|9|@$I|1P|J|1Q|1|1R]]|A|$]]|$1|S|3|T|5|U|7|1S|8|@]|9|@]|A|$]]|$1|V|3|W|5|U|7|1T|8|@]|9|@]|A|$]]|$1|X|3|Y|5|U|7|1U|8|@]|9|@]|A|$]]|$1|Z|3|-4|5|6|7|1V|8|@]|9|@]|A|$]]|$1|10|3|11|5|6|7|1W|8|@]|9|@]|A|$]]|$1|12|3|-4|5|6|7|1X|8|@]|9|@]|A|$]]]|13|$14|$5|15|16|17|A|$18|19]]|1A|$5|15|16|17|A|$18|1B]]]]

When you setup WP you (the webserver) may need write access to the files. So the access rights may need to be loose.

<pre class="lang-sh prettyprint-override"><code>chown www-data:www-data -R * # Let Apache be owner
find . -type d -exec chmod 755 {} \; # Change directory permissions rwxr-xr-x
find . -type f -exec chmod 644 {} \; # Change file permissions rw-r--r--
</code></pre>

After the setup you should tighten the access rights, according to <a href="https://wordpress.org/support/article/hardening-wordpress/" rel="noreferrer">Hardening WordPress</a> all files except for wp-content should be writable by your user account only. wp-content must be writable by www-data too.

<pre class="lang-sh prettyprint-override"><code>chown &lt;username&gt;:&lt;username&gt; -R * # Let your useraccount be owner
chown www-data:www-data wp-content # Let apache be owner of wp-content
</code></pre>

Maybe you want to change the contents in wp-content later on. In this case you could

<ul>
<li>temporarily change to the user to www-data with <code>su</code>,</li>
<li>give wp-content group write access 775 and join the group www-data or </li>
<li>give your user the access rights to the folder using <a href="https://wiki.archlinux.org/index.php/Access_Control_Lists" rel="noreferrer">ACLs</a>.</li>
</ul>

Whatever you do, make sure the files have rw permissions for www-data.

blocks|key|3000844|text|向www-data用户(在本例中为web服务器用户)授予对所有wp文件的完全访问权限可能很危险。所以最好不要这样做：|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|3000845|chown+www-data:www-data+-R+*|code-block|syntax|javascript|3000846|但是，在安装或升级WordPress及其插件时，它可能会很有用。但是，当您完成后，保留web服务器拥有的wp文件不再是一个好主意。|3000847|它基本上允许web服务器放入或覆盖您网站中的任何文件。这意味着，如果有人设法使用web服务器(或某些.php脚本中的安全漏洞)将一些文件放入您的网站中，就有可能接管您的网站。|3000848|为了保护您的站点免受此类攻击，您应该采取以下措施：|3000849|3000850|所有文件应归您的用户帐户所有，并且应可由您写入。任何需要从WordPress写访问的文件都应该是web服务器可写的，如果您的主机设置需要的话，这可能意味着这些文件需要由web服务器进程使用的用户帐户拥有。|blockquote|3000851|3000852|/|3000853|WordPress根目录:只有您的用户帐户才能写入所有文件，如果您希望WordPress自动为您生成重写规则，则.htaccess除外。|3000854|/wp-admin/|3000855|WordPress管理区域:所有文件都应该只对您的用户帐户可写。|3000856|/wp-includes/|3000857|WordPress应用程序逻辑的主要部分:所有文件都应该只对您的用户帐户可写。/wp-content/|3000858|用户提供的内容:可由您的用户帐户和web服务器进程写入。|3000859|在/wp-content/中，您将发现：|3000860|/wp-content/themes/|3000861|主题文件。如果你想使用内置的主题编辑器，所有的文件都需要是web服务器进程可写的。如果您不想使用内置的主题编辑器，则所有文件都只能由您的用户帐户写入。/wp-content/plugins/|3000862|插件文件:所有文件都应该只对您的用户帐户可写。|3000863|可能存在于/wp-content/中的其他目录应该由任何需要它们的插件或主题来记录。权限可能有所不同。|3000864|3000865|来源和更多信息：http://codex.wordpress.org/Hardening_WordPress|3000866|entityMap|0|LINK|mutability|MUTABLE|url|http://codex.wordpress.org/Hardening_WordPress^0|1|8|0|0|0|0|0|0|0|0|0|1|0|0|0|A|0|0|0|D|0|13|C|0|0|1|C|0|0|J|0|23|K|0|0|5|C|0|0|8|1A|0|0^^$0|@$1|2|3|4|5|6|7|1U|8|@$9|1V|A|1W|B|C]]|D|@]|E|$]]|$1|F|3|G|5|H|7|1X|8|@]|D|@]|E|$I|J]]|$1|K|3|L|5|6|7|1Y|8|@]|D|@]|E|$]]|$1|M|3|N|5|6|7|1Z|8|@]|D|@]|E|$]]|$1|O|3|P|5|6|7|20|8|@]|D|@]|E|$]]|$1|Q|3|-4|5|6|7|21|8|@]|D|@]|E|$]]|$1|R|3|S|5|T|7|22|8|@]|D|@]|E|$]]|$1|U|3|-4|5|6|7|23|8|@]|D|@]|E|$]]|$1|V|3|W|5|6|7|24|8|@$9|25|A|26|B|C]]|D|@]|E|$]]|$1|X|3|Y|5|6|7|27|8|@]|D|@]|E|$]]|$1|Z|3|10|5|6|7|28|8|@$9|29|A|2A|B|C]]|D|@]|E|$]]|$1|11|3|12|5|6|7|2B|8|@]|D|@]|E|$]]|$1|13|3|14|5|6|7|2C|8|@$9|2D|A|2E|B|C]]|D|@]|E|$]]|$1|15|3|16|5|6|7|2F|8|@$9|2G|A|2H|B|C]]|D|@]|E|$]]|$1|17|3|18|5|6|7|2I|8|@]|D|@]|E|$]]|$1|19|3|1A|5|6|7|2J|8|@$9|2K|A|2L|B|C]]|D|@]|E|$]]|$1|1B|3|1C|5|6|7|2M|8|@$9|2N|A|2O|B|C]]|D|@]|E|$]]|$1|1D|3|1E|5|6|7|2P|8|@$9|2Q|A|2R|B|C]]|D|@]|E|$]]|$1|1F|3|1G|5|6|7|2S|8|@]|D|@]|E|$]]|$1|1H|3|1I|5|6|7|2T|8|@$9|2U|A|2V|B|C]]|D|@]|E|$]]|$1|1J|3|-4|5|6|7|2W|8|@]|D|@]|E|$]]|$1|1K|3|1L|5|6|7|2X|8|@]|D|@$9|2Y|A|2Z|1|30]]|E|$]]|$1|1M|3|-4|5|6|7|31|8|@]|D|@]|E|$]]]|1N|$1O|$5|1P|1Q|1R|E|$1S|1T]]]]

Giving the full access to all wp files to <code>www-data</code> user (which is in this case the web server user) can be dangerous. 
So rather do NOT do this:

<pre><code>chown www-data:www-data -R *
</code></pre>

It can be useful however in the moment when you're installing or upgrading WordPress and its plug-ins. But when you finished it's no longer a good idea to keep wp files owned by the web server.

It basically allows the web server to put or overwrite any file in your website.
This means that there is a possibility to take over your site if someone manage to use the web server (or a security hole in some .php script) to put some files in your website.

To protect your site against such an attack you should to the following:

<blockquote>
 All files should be owned by your user account, and should be writable
 by you. Any file that needs write access from WordPress should be
 writable by the web server, if your hosting set up requires it, that
 may mean those files need to be group-owned by the user account used
 by the web server process.
 
 <h2><code>/</code></h2>
 
 The root WordPress directory: all files should be writable only by your user account, except .htaccess if you want WordPress to
 automatically generate rewrite rules for you.
 
 <h2><code>/wp-admin/</code></h2>
 
 The WordPress administration area: all files should be writable only by your user account. 
 
 <h2><code>/wp-includes/</code></h2>
 
 The bulk of WordPress application logic: all files should be writable only by your user account. 
 
 <h2><code>/wp-content/</code></h2>
 
 User-supplied content: intended to be writable by your user account and the web server process. 
 
 Within <code>/wp-content/</code> you will find:
 
 <h2><code>/wp-content/themes/</code></h2>
 
 Theme files. If you want to use the built-in theme editor, all files need to be writable by the web server process. If you do not
 want to use the built-in theme editor, all files can be writable only
 by your user account. 
 
 <h2><code>/wp-content/plugins/</code></h2>
 
 Plugin files: all files should be writable only by your user account. 
 
 Other directories that may be present with <code>/wp-content/</code> should be
 documented by whichever plugin or theme requires them. Permissions may
 vary.
</blockquote>

Source and additional information: <a href="http://codex.wordpress.org/Hardening_WordPress">http://codex.wordpress.org/Hardening_WordPress</a>

blocks|key|2788500|text|对于那些将wordpress根文件夹放在主文件夹下的用户：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2788501|**+Ubuntu/apache|2788502|2788503|将您的用户添加到www-data组：|ordered-list-item|2788504|2788505|瑞士信贷Granting+write+permissions+to+www-data+group|offset|length|2788506|你想对你的用户调用usermod。所以这将是：|style|CODE|2788507|sudo+usermod+-aG+www-data+yourUserName|code-block|syntax|javascript|2788508|**假设www-data组存在|2788509|2788510|检查您的用户是否在www-data组中：|2788511|2788512|groups+yourUserName|2788513|你应该会得到类似这样的东西：|2788514|youUserName+:+youUserGroupName+www-data|2788515|**+youUserGroupName通常与您的用户名相似|2788516|2788517|递归地更改wp-content文件夹的组所有权，保留您的用户所有权。|2788518|2788519|内容目录youWebSiteFolder/wp-+chown+yourUserName:www-data+-R+youWebSiteFolder/wp-content/*|2788520|Change+/|unordered-list-item|2788521|2788522|cd+youWebSiteFolder/wp-content|2788523|Recursively更改文件夹和子文件夹的组权限以启用写入权限：|2788524|2788525|find+.+-type+d+-exec+chmod+-R+775+{}+\;|2788526|**+`/home/yourUserName/youWebSiteFolder/wp-content/‘的模式从0755+(rwxr-xr-x)变为0775+(rwxrwxr-x)|2788527|2788528|递归地更改文件和子文件的组权限，以启用写权限：|2788529|2788530|find+.+-type+f+-exec+chmod+-R+664+{}+\;|2788531|结果应该类似于：|2788532|WAS:
-rw-r--r--++1+yourUserName+www-data++7192+Oct++4+00:03+filename.html
CHANGED+TO:
-rw-rw-r--++1+yourUserName+www-data++7192+Oct++4+00:03+filename.html|2788533|等同于：|2788534|chmod+-R+ug%2Brw文件夹名称|2788535|权限将类似于文件的664或目录的775。|2788536|附注：如果任何人在更新插件时遇到错误'could+not+create+directory'，请执行以下操作：|2788537|server@user:~/domainame.com$+sudo+chown+username:www-data+-R+wp-content|2788538|当您处于域的根目录时。|2788539|假设：wp-config.php具有|BOLD|2788540|FTP+credentials+on+LocalHost|2788541|define('FS_METHOD','direct');|2788542|entityMap|0|LINK|mutability|MUTABLE|url|https://superuser.com/questions/646062/granting-write-permissions-to-www-data-group|1|https://wordpress.stackexchange.com/questions/57166/ftp-credentials-on-localhost^0|0|0|0|0|0|4|18|0|0|9|7|0|0|4|8|0|0|9|8|0|0|0|J|0|0|0|0|0|0|0|P|1O|0|0|0|0|U|0|0|0|0|13|0|0|0|0|0|0|13|0|0|0|0|0|0|I|S|0|0|1Z|0|0|3|D|3|D|0|0|S|1|0|0|T|0^^$0|@$1|2|3|4|5|6|7|2V|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|2W|8|@]|9|@]|A|$]]|$1|D|3|-4|5|6|7|2X|8|@]|9|@]|A|$]]|$1|E|3|F|5|G|7|2Y|8|@]|9|@]|A|$]]|$1|H|3|-4|5|6|7|2Z|8|@]|9|@]|A|$]]|$1|I|3|J|5|6|7|30|8|@]|9|@$K|31|L|32|1|33]]|A|$]]|$1|M|3|N|5|6|7|34|8|@$K|35|L|36|O|P]]|9|@]|A|$]]|$1|Q|3|R|5|S|7|37|8|@]|9|@]|A|$T|U]]|$1|V|3|W|5|6|7|38|8|@$K|39|L|3A|O|P]]|9|@]|A|$]]|$1|X|3|-4|5|6|7|3B|8|@]|9|@]|A|$]]|$1|Y|3|Z|5|G|7|3C|8|@$K|3D|L|3E|O|P]]|9|@]|A|$]]|$1|10|3|-4|5|6|7|3F|8|@]|9|@]|A|$]]|$1|11|3|12|5|6|7|3G|8|@$K|3H|L|3I|O|P]]|9|@]|A|$]]|$1|13|3|14|5|6|7|3J|8|@]|9|@]|A|$]]|$1|15|3|16|5|S|7|3K|8|@]|9|@]|A|$T|U]]|$1|17|3|18|5|6|7|3L|8|@]|9|@]|A|$]]|$1|19|3|-4|5|6|7|3M|8|@]|9|@]|A|$]]|$1|1A|3|1B|5|G|7|3N|8|@]|9|@]|A|$]]|$1|1C|3|-4|5|6|7|3O|8|@]|9|@]|A|$]]|$1|1D|3|1E|5|6|7|3P|8|@$K|3Q|L|3R|O|P]]|9|@]|A|$]]|$1|1F|3|1G|5|1H|7|3S|8|@]|9|@]|A|$]]|$1|1I|3|-4|5|6|7|3T|8|@]|9|@]|A|$]]|$1|1J|3|1K|5|6|7|3U|8|@$K|3V|L|3W|O|P]]|9|@]|A|$]]|$1|1L|3|1M|5|1H|7|3X|8|@]|9|@]|A|$]]|$1|1N|3|-4|5|6|7|3Y|8|@]|9|@]|A|$]]|$1|1O|3|1P|5|6|7|3Z|8|@$K|40|L|41|O|P]]|9|@]|A|$]]|$1|1Q|3|1R|5|6|7|42|8|@]|9|@]|A|$]]|$1|1S|3|-4|5|6|7|43|8|@]|9|@]|A|$]]|$1|1T|3|1U|5|G|7|44|8|@]|9|@]|A|$]]|$1|1V|3|-4|5|6|7|45|8|@]|9|@]|A|$]]|$1|1W|3|1X|5|6|7|46|8|@$K|47|L|48|O|P]]|9|@]|A|$]]|$1|1Y|3|1Z|5|6|7|49|8|@]|9|@]|A|$]]|$1|20|3|21|5|S|7|4A|8|@]|9|@]|A|$T|U]]|$1|22|3|23|5|6|7|4B|8|@]|9|@]|A|$]]|$1|24|3|25|5|6|7|4C|8|@]|9|@]|A|$]]|$1|26|3|27|5|6|7|4D|8|@]|9|@]|A|$]]|$1|28|3|29|5|6|7|4E|8|@$K|4F|L|4G|O|P]]|9|@]|A|$]]|$1|2A|3|2B|5|6|7|4H|8|@$K|4I|L|4J|O|P]]|9|@]|A|$]]|$1|2C|3|2D|5|6|7|4K|8|@]|9|@]|A|$]]|$1|2E|3|2F|5|6|7|4L|8|@$K|4M|L|4N|O|2G]|$K|4O|L|4P|O|P]]|9|@]|A|$]]|$1|2H|3|2I|5|6|7|4Q|8|@]|9|@$K|4R|L|4S|1|4T]]|A|$]]|$1|2J|3|2K|5|6|7|4U|8|@$K|4V|L|4W|O|P]]|9|@]|A|$]]|$1|2L|3|-4|5|6|7|4X|8|@]|9|@]|A|$]]]|2M|$2N|$5|2O|2P|2Q|A|$2R|2S]]|2T|$5|2O|2P|2Q|A|$2R|2U]]]]

For those who have their wordpress root folder under their home folder:

** Ubuntu/apache

<ol>
<li>Add your user to www-data group:</li>
</ol>

CREDIT <a href="https://superuser.com/questions/646062/granting-write-permissions-to-www-data-group">Granting write permissions to www-data group</a>

You want to call <code>usermod</code> on your user. So that would be:

<pre><code>sudo usermod -aG www-data yourUserName
</code></pre>

** Assuming <code>www-data</code> group exists

<ol start="2">
<li>Check your user is in <code>www-data</code> group:

<code>groups yourUserName</code></li>
</ol>

You should get something like:

<pre><code>youUserName : youUserGroupName www-data
</code></pre>

** youUserGroupName is usually similar to you user name

<ol start="3">
<li>Recursively change group ownership of the wp-content folder keeping your user ownership

<code>chown yourUserName:www-data -R youWebSiteFolder/wp-content/*</code></li>
<li>Change directory to youWebSiteFolder/wp-content/

<code>cd youWebSiteFolder/wp-content</code></li>
<li>Recursively change group permissions of the folders and sub-folders to enable write permissions:

<code>find . -type d -exec chmod -R 775 {} \;</code></li>
</ol>

** mode of `/home/yourUserName/youWebSiteFolder/wp-content/' changed from 0755 (rwxr-xr-x) to 0775 (rwxrwxr-x)

<ol start="6">
<li>Recursively change group permissions of the files and sub-files to enable write permissions:

<code>find . -type f -exec chmod -R 664 {} \;</code></li>
</ol>

The result should look something like:

<pre><code>WAS:
-rw-r--r-- 1 yourUserName www-data 7192 Oct 4 00:03 filename.html
CHANGED TO:
-rw-rw-r-- 1 yourUserName www-data 7192 Oct 4 00:03 filename.html
</code></pre>

Equivalent to:

chmod -R ug+rw foldername

Permissions will be like 664 for files or 775 for directories.

P.s. if anyone encounters error <code>'could not create directory'</code> when updating a plugin, do: 
<code>server@user:~/domainame.com$ sudo chown username:www-data -R wp-content</code> 
when you are at the root of your domain. 
Assuming: <code>wp-config.php</code> has 
<a href="https://wordpress.stackexchange.com/questions/57166/ftp-credentials-on-localhost">FTP credentials on LocalHost</a> 
<code>define('FS_METHOD','direct');</code>

blocks|key|2788603|text|命令：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2788604|chown+www-data:www-data+-R+*
find+.+-type+d+-exec+chmod+755+{}+\;
find+.+-type+f+-exec+chmod+644+{}+\;|code-block|syntax|javascript|2788605|其中ftp-user是您用来上传文件的用户|2788606|chown+-R+ftp-user:www-data+wp-content
chmod+-R+775+wp-content|2788607|entityMap^0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|M|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|N|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|O|8|@]|9|@]|A|$]]|$1|I|3|J|5|D|7|P|8|@]|9|@]|A|$E|F]]|$1|K|3|-4|5|6|7|Q|8|@]|9|@]|A|$]]]|L|$]]

Commands:

<pre><code>chown www-data:www-data -R *
find . -type d -exec chmod 755 {} \;
find . -type f -exec chmod 644 {} \;
</code></pre>

Where ftp-user is what user you are using to upload the files

<pre><code>chown -R ftp-user:www-data wp-content
chmod -R 775 wp-content
</code></pre>

blocks|key|2788615|text|我认为对于默认的wordpress站点，推荐使用以下规则：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2788616|2788617|对于wp-content内的文件夹，设置0755权限：chmod+-R+0755+|unordered-list-item|offset|length|style|BOLD|2788618|2788619|2788620|chmod+-R+0755上传|2788621|apache+chmod+-R+0755+upgrade|2788622|Let+apache用户是上述wp--R目录的所有者：|2788623|2788624|chown+apache上传|2788625|chown+apache升级|2788626|plugins+chown+apache|2788627|entityMap^0|0|0|R|E|0|0|0|0|F|0|0|0|0|0|E|0|0|E|0|8|C|0^^$0|@$1|2|3|4|5|6|7|10|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|11|8|@]|9|@]|A|$]]|$1|C|3|D|5|E|7|12|8|@$F|13|G|14|H|I]]|9|@]|A|$]]|$1|J|3|-4|5|E|7|15|8|@]|9|@]|A|$]]|$1|K|3|-4|5|6|7|16|8|@]|9|@]|A|$]]|$1|L|3|M|5|6|7|17|8|@$F|18|G|19|H|I]]|9|@]|A|$]]|$1|N|3|O|5|6|7|1A|8|@]|9|@]|A|$]]|$1|P|3|Q|5|E|7|1B|8|@]|9|@]|A|$]]|$1|R|3|-4|5|6|7|1C|8|@]|9|@]|A|$]]|$1|S|3|T|5|6|7|1D|8|@$F|1E|G|1F|H|I]]|9|@]|A|$]]|$1|U|3|V|5|6|7|1G|8|@$F|1H|G|1I|H|I]]|9|@]|A|$]]|$1|W|3|X|5|6|7|1J|8|@$F|1K|G|1L|H|I]]|9|@]|A|$]]|$1|Y|3|-4|5|6|7|1M|8|@]|9|@]|A|$]]]|Z|$]]

I think the below rules are recommended for a default wordpress site:

<ul>
<li>For folders inside wp-content, set 0755 permissions: 

chmod -R 0755 plugins 

chmod -R 0755 uploads 

chmod -R 0755 upgrade</li>
<li>Let apache user be the owner for the above directories of wp-content:

chown apache uploads

chown apache upgrade

chown apache plugins</li>
</ul>

blocks|key|177095|text|我将权限设置为：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|177096|++++#+Set+all+files+and+directories+user+and+group+to+wp-user
++++chown+wp-user:wp-user+-R+*

++++#+Set+uploads+folder+user+and+group+to+www-data
++++chown+www-data:www-data+-R+wp-content/uploads/

++++#+Set+all+directories+permissions+to+755
++++find+.+-type+d+-exec+chmod+755+{}+\;

++++#+Set+all+files+permissions+to+644
++++find+.+-type+f+-exec+chmod+644+{}+\;|code-block|syntax|javascript|177097|在我的例子中，我为WordPress创建了一个特定的用户，它不同于apache的默认用户，它阻止从web访问该用户拥有的那些文件。|177098|然后，它授予apache用户处理上传文件夹的权限，并最终设置足够安全的文件和文件夹权限。|177099|编辑的|offset|length|style|BOLD|177100|如果您使用的是W3C总缓存，您还应该执行下一步：|177101|rm+-rf+wp-content/cache/config
rm+-rf+wp-content/cache/object
rm+-rf+wp-content/cache/db
rm+-rf+wp-content/cache/minify
rm+-rf+wp-content/cache/page_enhanced|177102|然后它就会起作用了！|177103|177104|在开发了一段时间的WordPress站点之后，我建议每个环境都有不同的文件权限：|177105|在生产环境中，我不会给用户修改文件系统的权限，我只允许他们上传资源和访问一些插件的特定文件夹来做备份，等等。但是在Git下管理项目和在服务器上使用部署密钥，这不是很好的升级插件。我在这里完成生产文件的设置：|177106|#+Set+uploads+folder+user+and+group+to+www-data
chown+www-data:www-data+-R+wp-content/uploads/|177107|www-data:www-data+=+apache或nginx用户和组|177108|暂存将共享相同的生产权限，因为它应该是它的克隆。|177109|最后，开发环境将可以访问更新插件，翻译，一切……|177110|#+Set+uploads+folder+user+and+group+to+www-data
chown+www-data:www-data+-R+wp-content/

#+Set+uploads+folder+user+and+group+to+www-data
chown+your-user:root-group+-R+wp-content/themes

#+Set+uploads+folder+user+and+group+to+www-data
chown+your-user:root-group+-R+wp-content/plugins/your-plugin|177111|www-data:www-data+=+apache或nginx用户，并对您的-+user+:+root+-+group+=当前用户和根组进行分组|177112|这些权限将允许您在不询问权限的情况下访问themes和your-plugin文件夹下的开发。其余内容将归Apache或Nginx用户所有，以允许WP管理文件系统。|CODE|177113|在创建git存储库之前，首先运行以下命令：|177114|#+Set+all+directories+permissions+to+755
find+.+-type+d+-exec+chmod+755+{}+\;

#+Set+all+files+permissions+to+644
find+.+-type+f+-exec+chmod+644+{}+\;|177115|entityMap^0|0|0|0|0|0|3|0|0|0|0|0|3|0|0|0|0|0|0|0|0|0|K|6|R|B|0|0|0^^$0|@$1|2|3|4|5|6|7|1M|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|1N|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|1O|8|@]|9|@]|A|$]]|$1|I|3|J|5|6|7|1P|8|@]|9|@]|A|$]]|$1|K|3|L|5|6|7|1Q|8|@$M|1R|N|1S|O|P]]|9|@]|A|$]]|$1|Q|3|R|5|6|7|1T|8|@]|9|@]|A|$]]|$1|S|3|T|5|D|7|1U|8|@]|9|@]|A|$E|F]]|$1|U|3|V|5|6|7|1V|8|@]|9|@]|A|$]]|$1|W|3|L|5|6|7|1W|8|@$M|1X|N|1Y|O|P]]|9|@]|A|$]]|$1|X|3|Y|5|6|7|1Z|8|@]|9|@]|A|$]]|$1|Z|3|10|5|6|7|20|8|@]|9|@]|A|$]]|$1|11|3|12|5|D|7|21|8|@]|9|@]|A|$E|F]]|$1|13|3|14|5|6|7|22|8|@]|9|@]|A|$]]|$1|15|3|16|5|6|7|23|8|@]|9|@]|A|$]]|$1|17|3|18|5|6|7|24|8|@]|9|@]|A|$]]|$1|19|3|1A|5|D|7|25|8|@]|9|@]|A|$E|F]]|$1|1B|3|1C|5|6|7|26|8|@]|9|@]|A|$]]|$1|1D|3|1E|5|6|7|27|8|@$M|28|N|29|O|1F]|$M|2A|N|2B|O|1F]]|9|@]|A|$]]|$1|1G|3|1H|5|6|7|2C|8|@]|9|@]|A|$]]|$1|1I|3|1J|5|D|7|2D|8|@]|9|@]|A|$E|F]]|$1|1K|3|-4|5|6|7|2E|8|@]|9|@]|A|$]]]|1L|$]]

I set permissions to:

<pre><code> # Set all files and directories user and group to wp-user
 chown wp-user:wp-user -R *

 # Set uploads folder user and group to www-data
 chown www-data:www-data -R wp-content/uploads/

 # Set all directories permissions to 755
 find . -type d -exec chmod 755 {} \;

 # Set all files permissions to 644
 find . -type f -exec chmod 644 {} \;
</code></pre>

In my case I created a specific user for WordPress which is different from the apache default user that prevent access from the web to those files owned by that user.

Then it gives permission to apache user to handle the upload folder and finally set secure enough file and folder permissions.

EDITED

If you're using W3C Total Cache you should do the next also:

<pre><code>rm -rf wp-content/cache/config
rm -rf wp-content/cache/object
rm -rf wp-content/cache/db
rm -rf wp-content/cache/minify
rm -rf wp-content/cache/page_enhanced
</code></pre>

Then it'll work!

EDITED

After a while developing WordPress sites I'd recommend different file permissions per environment:

In production, I wouldn't give access to users to modify the filesystem, I'll only allow them to upload resources and give access to some plugins specific folders to do backups, etc. But managing projects under Git and using deploy keys on the server, it isn't good update plugins on staging nor production. I leave here the production file setup:

<pre><code># Set uploads folder user and group to www-data
chown www-data:www-data -R wp-content/uploads/
</code></pre>

www-data:www-data = apache or nginx user and group

Staging will share the same production permissions as it should be a clone of it.

Finally, development environment will have access to update plugins, translations, everything...

<pre><code># Set uploads folder user and group to www-data
chown www-data:www-data -R wp-content/

# Set uploads folder user and group to www-data
chown your-user:root-group -R wp-content/themes

# Set uploads folder user and group to www-data
chown your-user:root-group -R wp-content/plugins/your-plugin
</code></pre>

www-data:www-data = apache or nginx user and group
your-user:root-group = your current user and the root group

These permissions will give you access to develop under <code>themes</code> and <code>your-plugin</code> folder without asking permission. The rest of the content will be owned by the Apache or Nginx user to allow WP to manage the filesystem.

Before creating a git repo first run these commands:

<pre><code># Set all directories permissions to 755
find . -type d -exec chmod 755 {} \;

# Set all files permissions to 644
find . -type f -exec chmod 644 {} \;
</code></pre>

blocks|key|181154|text|我不能告诉你这是否正确，但我正在使用Google+Compute+App+Engine上的Bitnami图像。我在插件和迁移方面遇到了问题，在通过修改权限进一步搞乱之后，我找到了这三行代码，它们解决了我所有的问题。不确定这是否是正确的方式，但对我来说是有效的。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|181155|sudo+chown+-R+bitnami:daemon+/opt/bitnami/apps/wordpress/htdocs/
sudo+find+/opt/bitnami/apps/wordpress/htdocs/+-type+f+-exec+chmod+664+{}+\;
sudo+find+/opt/bitnami/apps/wordpress/htdocs/+-type+d+-exec+chmod+775+{}+\;|code-block|syntax|javascript|181156|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

I can't tell you whether or not this is correct, but I am using a Bitnami image over Google Compute App Engine. I has having problems with plugins and migration, and after further messing things up by chmod'ing permissions, I found these three lines which solved all my problems. Not sure if it's the proper way but worked for me.

<pre><code>sudo chown -R bitnami:daemon /opt/bitnami/apps/wordpress/htdocs/
sudo find /opt/bitnami/apps/wordpress/htdocs/ -type f -exec chmod 664 {} \;
sudo find /opt/bitnami/apps/wordpress/htdocs/ -type d -exec chmod 775 {} \;
</code></pre>

blocks|key|3001064|text|文件的正确权限为644，文件夹的正确权限为755|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3001065|要更改权限，请使用终端和以下命令。|3001066|find+foldername+-type+d+-exec+chmod+755+{}+\;
find+foldername+-type+f+-exec+chmod+644+{}+\;|code-block|syntax|javascript|3001067|755用于文件夹，644用于文件。|3001068|entityMap^0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|M|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|N|8|@]|9|@]|A|$]]|$1|D|3|E|5|F|7|O|8|@]|9|@]|A|$G|H]]|$1|I|3|J|5|6|7|P|8|@]|9|@]|A|$]]|$1|K|3|-4|5|6|7|Q|8|@]|9|@]|A|$]]]|L|$]]

Correct permissions for the file is 644
Correct permissions for the folder is 755

To change the permissions , use terminal and following commands.

<pre><code>find foldername -type d -exec chmod 755 {} \;
find foldername -type f -exec chmod 644 {} \;
</code></pre>

755 for folders and 644 for files.

blocks|key|181160|text|对于OS+X，请使用以下命令：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|181161|sudo+chown+-R+www:www+/www/folder_name|code-block|syntax|javascript|181162|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

For OS X use this command:

<pre><code>sudo chown -R www:www /www/folder_name
</code></pre>

blocks|key|179277|text|要绝对确保您的网站是安全的，并且您对您的文件夹使用了正确的权限，请使用以下安全插件：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|179278|https://en-ca.wordpress.org/plugins/all-in-one-wp-security-and-firewall/|offset|length|179279|https://en-ca.wordpress.org/plugins/wordfence/|179280|这些插件将扫描你的Wordpress安装，并通知你任何潜在的问题。这些还将警告您任何不安全的文件夹权限。除此之外，这些插件还会向你推荐应该分配给文件夹的权限。|179281|entityMap|0|LINK|mutability|MUTABLE|url|1^0|0|0|20|0|0|0|1A|1|0|0^^$0|@$1|2|3|4|5|6|7|R|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|S|8|@]|9|@$D|T|E|U|1|V]]|A|$]]|$1|F|3|G|5|6|7|W|8|@]|9|@$D|X|E|Y|1|Z]]|A|$]]|$1|H|3|I|5|6|7|10|8|@]|9|@]|A|$]]|$1|J|3|-4|5|6|7|11|8|@]|9|@]|A|$]]]|K|$L|$5|M|N|O|A|$P|C]]|Q|$5|M|N|O|A|$P|G]]]]

To absolutely make sure that your website is secure and you are using correct permissions for your folders, use a security plugin like these:

<a href="https://en-ca.wordpress.org/plugins/all-in-one-wp-security-and-firewall/" rel="nofollow">https://en-ca.wordpress.org/plugins/all-in-one-wp-security-and-firewall/</a>

<a href="https://en-ca.wordpress.org/plugins/wordfence/" rel="nofollow">https://en-ca.wordpress.org/plugins/wordfence/</a>

These plugins will scan your Wordpress installation and notify you about any potential issues. These will also warn you about any insecure folder permissions. In addition to that, these plugins will recommend you what permissions should be assigned to the folders.

blocks|key|3001109|text|这实际上取决于你计划使用的插件，因为一些插件会改变wordpress的根文档。但通常我建议在wordpress目录中使用类似这样的代码。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3001110|这将在每个单独的文件/文件夹中分配"root“(或您使用的任何用户)作为用户，R表示递归，因此它不会停止在"html”文件夹。如果你没有使用R，那么它只适用于"html“目录。|3001111|sudo+chown+-R+root:www-data+/var/www/html++|code-block|syntax|javascript|3001112|3001113|这会将"wp-content“的所有者/组设置为"www-data”，从而允许web服务器通过管理面板安装插件。|3001114|chown+-R+www-data:www-data+/var/www/html/wp-content|3001115|3001116|这将"html“文件夹中的每个文件(包括子目录中的文件)的权限设置为644，因此外部人员不能执行任何文件，修改任何文件，组不能执行任何文件，修改任何文件，只有用户可以修改/读取文件，但即使用户也不能执行任何文件。这一点很重要，因为它阻止了在"+html“文件夹中的任何类型的执行，而且由于html文件夹和除wp-content文件夹之外的所有其他文件夹的所有者都是"root”(或您的用户)，所以www-data不能修改wp-content文件夹之外的任何文件，所以即使web服务器中存在任何漏洞，如果有人未经授权访问该站点，他们也不能删除除插件之外的主站点。|3001117|sudo+find+/var/www/html+-type+f+-exec+chmod+644+{}+%2B|3001118|3001119|这将限制具有rw-r-这些权限的用户/组访问"wp-config.php“的权限。|3001120|chmod+640+/var/www/html/wp-config.php|3001121|3001122|如果插件或更新程序抱怨无法更新，则访问SSH并使用此命令，并通过管理面板授予"www-data“(web服务器)更新/安装的临时权限，然后在更新完成后恢复到"root”或您的用户。|3001123|chown+-R+www-data+/var/www/html|3001124|3001125|以及在Nginx+(与apache相同的过程)中保护wp-admin文件夹，防止未经授权的访问和探查。apache2-utils是加密密码所必需的，即使您已经安装了nginx，如果您计划将更多用户添加到同一文件中，请省略c。|3001126|sudo+apt-get+install+apache2-utils
sudo+htpasswd+-c+/etc/nginx/.htpasswd+userName|3001127|现在访问此位置|3001128|/etc/nginx/sites-available/|3001129|使用此代码保护"wp-admin“文件夹的密码，现在它将询问密码/用户名，如果您试图访问"wp-admin”。注意，这里使用的是包含加密密码的".htpasswd“文件。|3001130|location+%5E~+/wp-admin+{
++++auth_basic+"Restricted";
++++auth_basic_user_file+/etc/nginx/.htpasswd;
++++index++index.php+index.html+index.htm;
}|3001131|现在重新启动nginx。|3001132|sudo+/etc/init.d/nginx+restart|3001133|entityMap^0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|1L|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|1M|8|@]|9|@]|A|$]]|$1|D|3|E|5|F|7|1N|8|@]|9|@]|A|$G|H]]|$1|I|3|-4|5|6|7|1O|8|@]|9|@]|A|$]]|$1|J|3|K|5|6|7|1P|8|@]|9|@]|A|$]]|$1|L|3|M|5|F|7|1Q|8|@]|9|@]|A|$G|H]]|$1|N|3|-4|5|6|7|1R|8|@]|9|@]|A|$]]|$1|O|3|P|5|6|7|1S|8|@]|9|@]|A|$]]|$1|Q|3|R|5|F|7|1T|8|@]|9|@]|A|$G|H]]|$1|S|3|-4|5|6|7|1U|8|@]|9|@]|A|$]]|$1|T|3|U|5|6|7|1V|8|@]|9|@]|A|$]]|$1|V|3|W|5|F|7|1W|8|@]|9|@]|A|$G|H]]|$1|X|3|-4|5|6|7|1X|8|@]|9|@]|A|$]]|$1|Y|3|Z|5|6|7|1Y|8|@]|9|@]|A|$]]|$1|10|3|11|5|F|7|1Z|8|@]|9|@]|A|$G|H]]|$1|12|3|-4|5|6|7|20|8|@]|9|@]|A|$]]|$1|13|3|14|5|6|7|21|8|@]|9|@]|A|$]]|$1|15|3|16|5|F|7|22|8|@]|9|@]|A|$G|H]]|$1|17|3|18|5|6|7|23|8|@]|9|@]|A|$]]|$1|19|3|1A|5|F|7|24|8|@]|9|@]|A|$G|H]]|$1|1B|3|1C|5|6|7|25|8|@]|9|@]|A|$]]|$1|1D|3|1E|5|F|7|26|8|@]|9|@]|A|$G|H]]|$1|1F|3|1G|5|6|7|27|8|@]|9|@]|A|$]]|$1|1H|3|1I|5|F|7|28|8|@]|9|@]|A|$G|H]]|$1|1J|3|-4|5|6|7|29|8|@]|9|@]|A|$]]]|1K|$]]

It actually depends on the plugins you plan to use as some plugins change the root document of the wordpress. but generally I recommend something like this for the wordpress directory.

This will assign the "root" (or whatever the user you are using) as the user in every single file/folder, R means recursive, so it just doesn't stop at the "html" folder. if you didn't use R, then it only applicable to the "html" directory. 

<pre><code>sudo chown -R root:www-data /var/www/html 
</code></pre>

<hr>

This will set the owner/group of "wp-content" to "www-data" and thus allowing the web server to install the plugins through the admin panel. 

<pre><code>chown -R www-data:www-data /var/www/html/wp-content
</code></pre>

<hr>

This will set the permission of every single file in "html" folder (Including files in subdirectories) to 644, so outside people can't execute any file, modify any file, group can't execute any file, modify any file and only the user is allowed to modify/read files, but still even the user can't execute any file. This is important because it prevents any kind of execution in "html" folder, also since the owner of the html folder and all other folders except the wp-content folder are "root" (or your user), the www-data can't modify any file outside of the wp-content folder, so even if there is any vulnerability in the web server, and if someone accessed to the site unauthorizedly, they can't delete the main site except the plugins. 

<pre><code>sudo find /var/www/html -type f -exec chmod 644 {} +
</code></pre>

<hr>

This will restrict the permission of accessing to "wp-config.php" to user/group with rw-r----- these permissions. 

<pre><code>chmod 640 /var/www/html/wp-config.php
</code></pre>

<hr>

And if a plugin or update complained it can't update, then access to the SSH and use this command, and grant the temporary permission to "www-data" (web server) to update/install through the admin panel, and then revert back to the "root" or your user once it's completed. 

<pre><code>chown -R www-data /var/www/html
</code></pre>

<hr>

And in Nginx (same procedure for the apache)to protect the wp-admin folder from unauthorized accessing, and probing. apache2-utils is required for encrypting the password even if you have nginx installed, omit c if you plan to add more users to the same file.

<pre><code>sudo apt-get install apache2-utils
sudo htpasswd -c /etc/nginx/.htpasswd userName
</code></pre>

Now visit this location 

<pre><code>/etc/nginx/sites-available/
</code></pre>

Use this codes to protect "wp-admin" folder with a password, now it will ask the password/username if you tried to access to the "wp-admin". notice, here you use the ".htpasswd" file which contains the encrypted password. 

<pre><code>location ^~ /wp-admin {
 auth_basic "Restricted";
 auth_basic_user_file /etc/nginx/.htpasswd;
 index index.php index.html index.htm;
}
</code></pre>

Now restart the nginx. 

<pre><code>sudo /etc/init.d/nginx restart
</code></pre>

blocks|key|3001135|text|chown+-Rv+www-data:www-data
chmod+-Rv+0755+wp-includes
chmod+-Rv+0755+wp-admin/js
chmod+-Rv+0755+wp-content/themes
chmod+-Rv+0755+wp-content/plugins
chmod+-Rv+0755+wp-admin
chmod+-Rv+0755+wp-content
chmod+-v+0644+wp-config.php
chmod+-v+0644+wp-admin/index.php
chmod+-v+0644+.htaccess|type|code-block|depth|inlineStyleRanges|entityRanges|data|syntax|javascript|3001136|unstyled|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|G|8|@]|9|@]|A|$B|C]]|$1|D|3|-4|5|E|7|H|8|@]|9|@]|A|$]]]|F|$]]

<pre><code>chown -Rv www-data:www-data
chmod -Rv 0755 wp-includes
chmod -Rv 0755 wp-admin/js
chmod -Rv 0755 wp-content/themes
chmod -Rv 0755 wp-content/plugins
chmod -Rv 0755 wp-admin
chmod -Rv 0755 wp-content
chmod -v 0644 wp-config.php
chmod -v 0644 wp-admin/index.php
chmod -v 0644 .htaccess
</code></pre>

blocks|key|179343|text|最好阅读此https://wordpress.org/support/article/changing-file-permissions/上的wordpress文档|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|179344|179345|blockquote|179346|179347|179348|所有文件应归实际用户帐户所有，而不是用于httpd+process+|unordered-list-item|179349|组所有权的用户帐户。除非对web服务器进程权限检查有特定的组要求，否则组所有权无关紧要。通常情况并非如此。|179350|所有目录应为755或750。|179351|所有文件应为644或640。例外:+wp-config.php应该是440或400，以防止服务器上的其他用户读取它。|179352|没有目录应该被给予777，甚至上传目录。由于php进程是以文件所有者的身份运行的，因此它会获得所有者权限，甚至可以写入755目录。|179353|179354|entityMap|0|LINK|mutability|MUTABLE|url|https://wordpress.org/support/article/changing-file-permissions/^0|5|1S|0|0|0|0|0|0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|12|8|@]|9|@$A|13|B|14|1|15]]|C|$]]|$1|D|3|-4|5|6|7|16|8|@]|9|@]|C|$]]|$1|E|3|-4|5|F|7|17|8|@]|9|@]|C|$]]|$1|G|3|-4|5|6|7|18|8|@]|9|@]|C|$]]|$1|H|3|-4|5|6|7|19|8|@]|9|@]|C|$]]|$1|I|3|J|5|K|7|1A|8|@]|9|@]|C|$]]|$1|L|3|M|5|K|7|1B|8|@]|9|@]|C|$]]|$1|N|3|O|5|K|7|1C|8|@]|9|@]|C|$]]|$1|P|3|Q|5|K|7|1D|8|@]|9|@]|C|$]]|$1|R|3|S|5|K|7|1E|8|@]|9|@]|C|$]]|$1|T|3|-4|5|6|7|1F|8|@]|9|@]|C|$]]|$1|U|3|-4|5|6|7|1G|8|@]|9|@]|C|$]]]|V|$W|$5|X|Y|Z|C|$10|11]]]]

Best to read the wordpress documentation on this <a href="https://wordpress.org/support/article/changing-file-permissions/" rel="nofollow noreferrer">https://wordpress.org/support/article/changing-file-permissions/</a>

<blockquote>
 <ul>
 <li>All files should be owned by the actual user's account, not the user account used for the httpd process</li>
 <li>Group ownership is irrelevant, unless there's specific group requirements for the web-server process permissions checking. This is not usually the case. </li>
 <li>All directories should be 755 or 750.</li>
 <li>All files should be 644 or 640. Exception: wp-config.php should be 440 or 400 to prevent other users on the server from reading it.</li>
 <li>No directories should ever be given 777, even upload directories. Since the php process is running as the owner of the files, it gets the owners permissions and can write to even a 755 directory.</li>
 </ul>
</blockquote>

blocks|key|177241|text|根据我在自己网站上的阅读和苦恼，在被黑客攻击后，我列出了上面的列表，其中包括一个名为Wordfence的Wordpress安全插件的权限。(与其无关)|type|unstyled|depth|inlineStyleRanges|entityRanges|data|177242|在我们的示例中，wordpress文档根目录是/var/www/html/example.com/public_html|177243|打开权限，以便www-data可以写入文档根目录，如下所示：|177244|cd+/var/www/html/example.com
sudo+chown+-R+www-data:www-data+public_html/|code-block|syntax|javascript|177245|现在，作为管理员，您可以从站点的仪表板执行更新。|177246|完成更新后的安全站点，请执行以下步骤：|177247|sudo+chown+-R+wp-user:wp-user+public_html/|177248|上面的命令将wordpress安装中的所有内容的权限更改为wordpress+FTP用户。|177249|cd+public_html/wp-content
sudo+chown+-R+www-data:wp-user+wflogs
sudo+chown+-R+www-data:wp-user+uploads|177250|上面的命令确保安全插件Wordfence可以访问它的日志。上传目录也可以通过www-data写入。|177251|cd+plugins
sudo+chown+-R+www-data:wp-user+wordfence/|177252|上面的命令还确保安全插件需要读写访问权限才能正常工作。|177253|目录和文件权限|177254|#+Set+all+directories+permissions+to+755
find+.+-type+d+-exec+chmod+755+{}+\;

#+Set+all+files+permissions+to+644
find+.+-type+f+-exec+chmod+644+{}+\;|177255|将wp-config.php的权限设置为640，这样只有wp-user才能读取此文件，其他用户则不能。440的权限不适用于具有上述文件所有权的我。|177256|sudo+chmod+640+wp-config.php|177257|使用SSH的Wordpress自动更新在PHP5上运行得很好，但由于PHP7.0+-ssh2bundeld与Ubuntu16.04的问题而与php7.0中断，我找不到如何安装正确的版本并使其工作。幸运的是，一个叫做ssh-sftp-updater-support+(免费)的非常可靠的插件使得在不需要libssh2的情况下使用SFTP自动更新成为可能。因此，除非在极少数情况下需要，否则上述权限永远不会松动。|offset|length|177258|entityMap|0|LINK|mutability|MUTABLE|url|https://wordpress.org/plugins/ssh-sftp-updater-support/^0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|2Z|O|0|0^^$0|@$1|2|3|4|5|6|7|1K|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|1L|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|1M|8|@]|9|@]|A|$]]|$1|F|3|G|5|H|7|1N|8|@]|9|@]|A|$I|J]]|$1|K|3|L|5|6|7|1O|8|@]|9|@]|A|$]]|$1|M|3|N|5|6|7|1P|8|@]|9|@]|A|$]]|$1|O|3|P|5|H|7|1Q|8|@]|9|@]|A|$I|J]]|$1|Q|3|R|5|6|7|1R|8|@]|9|@]|A|$]]|$1|S|3|T|5|H|7|1S|8|@]|9|@]|A|$I|J]]|$1|U|3|V|5|6|7|1T|8|@]|9|@]|A|$]]|$1|W|3|X|5|H|7|1U|8|@]|9|@]|A|$I|J]]|$1|Y|3|Z|5|6|7|1V|8|@]|9|@]|A|$]]|$1|10|3|11|5|6|7|1W|8|@]|9|@]|A|$]]|$1|12|3|13|5|H|7|1X|8|@]|9|@]|A|$I|J]]|$1|14|3|15|5|6|7|1Y|8|@]|9|@]|A|$]]|$1|16|3|17|5|H|7|1Z|8|@]|9|@]|A|$I|J]]|$1|18|3|19|5|6|7|20|8|@]|9|@$1A|21|1B|22|1|23]]|A|$]]|$1|1C|3|-4|5|6|7|24|8|@]|9|@]|A|$]]]|1D|$1E|$5|1F|1G|1H|A|$1I|1J]]]]

Based on all the reading and agonizing on my own sites and after having been hacked I have come up with the above list that includes permissions for a security plugin for Wordpress called Wordfence. (Not affiliated with it)

In our example, the wordpress document root is 
 /var/www/html/example.com/public_html

Open up the permissions so that www-data can write to the document root as follows:

<pre><code>cd /var/www/html/example.com
sudo chown -R www-data:www-data public_html/
</code></pre>

Now from the dashboard in your site, as an admin you can perform updates.

Secure Site after Updates are finished by following these steps:

<pre><code>sudo chown -R wp-user:wp-user public_html/
</code></pre>

The above command changes permissions of everything in the wordpress install to the wordpress FTP user.

<pre><code>cd public_html/wp-content
sudo chown -R www-data:wp-user wflogs
sudo chown -R www-data:wp-user uploads
</code></pre>

The above command ensures that the security plugin Wordfence has access to its logs. The uploads directory is also writeable by www-data.

<pre><code>cd plugins
sudo chown -R www-data:wp-user wordfence/
</code></pre>

The above command also ensures that the security plugin has required read write access for its proper function.

Directory and Files Permissions

<pre><code># Set all directories permissions to 755
find . -type d -exec chmod 755 {} \;

# Set all files permissions to 644
find . -type f -exec chmod 644 {} \;
</code></pre>

Set the permissions for wp-config.php to 640 so that only wp-user can read this file and no one else. Permissions of 440 didn't work for me with above file ownership.

<pre><code>sudo chmod 640 wp-config.php
</code></pre>

Wordpress automatic updates using SSH were working with fine with PHP5 but broke with PHP7.0 due to problems with php7.0-ssh2 bundeld with Ubuntu 16.04 and I couldn't find how to install the right version and make it work. Fortunately a very reliable plugin called <a href="https://wordpress.org/plugins/ssh-sftp-updater-support/" rel="nofollow noreferrer">ssh-sftp-updater-support</a> (free) makes automatic updates using SFTP possible without need for libssh2. So the above permissions never have to be loosened except in rare cases as needed.

blocks|key|2789021|text|在wp_config文件中定义。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2789022|2789023|+/var/www.html/Your-Project-File/wp-config.php|blockquote|2789024|2789025|2789026|define(+'FS_METHOD',+'direct'+);|code-block|syntax|javascript|2789027|chown+-更改文件/目录的所有权。即。文件/目录的所有者更改为指定的目录，但不修改权限。|2789028|sudo+chown+-R+www-data:www-data+/var/www|2789029|entityMap^0|0|0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|S|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|T|8|@]|9|@]|A|$]]|$1|C|3|D|5|E|7|U|8|@]|9|@]|A|$]]|$1|F|3|-4|5|6|7|V|8|@]|9|@]|A|$]]|$1|G|3|-4|5|6|7|W|8|@]|9|@]|A|$]]|$1|H|3|I|5|J|7|X|8|@]|9|@]|A|$K|L]]|$1|M|3|N|5|6|7|Y|8|@]|9|@]|A|$]]|$1|O|3|P|5|J|7|Z|8|@]|9|@]|A|$K|L]]|$1|Q|3|-4|5|6|7|10|8|@]|9|@]|A|$]]]|R|$]]

Define in wp_config file.

<blockquote>
 /var/www/html/Your-Project-File/wp-config.php
</blockquote>

<pre><code>define( 'FS_METHOD', 'direct' );
</code></pre>

chown - changes ownership of files/dirs. Ie. owner of the file/dir changes to the specified one, but it doesn't modify permissions.

<pre><code>sudo chown -R www-data:www-data /var/www
</code></pre>

I've had a look over <a href="https://wordpress.org/support/article/changing-file-permissions/" rel="noreferrer">here</a> but didn't find any details on the best file permissions. I also took a look at some of WordPress's form's questions over <a href="http://wordpress.org/support/topic/what-are-correct-file-permissions-1" rel="noreferrer">here too</a> but anybody that suggests 777 obviously needs a little lesson in security.

In short my question is this. What permissions should I have for the following:

<ol>
<li>root folder storing all the WordPress content</li>
<li>wp-admin</li>
<li>wp-content</li>
<li>wp-includes</li>
</ol>

and then all the files in each of those folders?

Correct file permissions for WordPress

我在上看了看，但没有找到任何关于最佳文件权限的细节。我也看了一些WordPress在上的问题，但是任何建议777的人显然都需要一点安全方面的教训。简而言之，我的问题是。我应该对以下内容拥有哪些权限：存储所有contentwp-adminwp-contentwp-includes的根文件夹然后是每个文件夹中的所有文件？

问WordPress的正确文件权限
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问WordPress的正确文件权限EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问WordPress的正确文件权限
EN