Comments on: WordPress Upload Management Tip

By: Derek

Derek — Sat, 19 Aug 2006 19:27:30 +0000

I 777′d my upload directory and found some injected .php files a few months later that were spewing out spam into Google. Looks like 777 isn’t safe!

By: Geof F. Morris

Geof F. Morris — Sat, 24 Dec 2005 03:56:05 +0000

The main one would be that you never have to muck about with an FTP client. The tool also generates clean, valid markup for you.

By: Lara

Lara — Sat, 24 Dec 2005 01:26:10 +0000

What’s the benefit to uploading this way vs. FTP?

By: Geof F. Morris

Geof F. Morris — Fri, 23 Dec 2005 23:06:52 +0000

Lara: Options –> Miscellaneous.

Dougal: That’s my experience as well.

By: Dougal Campbell

Dougal Campbell — Fri, 23 Dec 2005 20:34:55 +0000

Yeah, on all the servers *I* have dealt with, the web server runs as a different user. The exception would probably be web hosts who run PHP as a CGI process, which allows them to run it through suexec. But when PHP is installed as a module, it executes with the same permissions as the main apache instance, which is typically as the ‘nobody’ user (or a similarly unprivileged account).

You don’t *have* to make the wp-content directory writable for everything. Most parts of WP that need to write files under there are looking at particular subdirectory (cache, uploads, etc). Just make those writable, and there are fewer security concerns.