The ultimate file and folder permission guide to secure WordPress

✨ Quick Answer

WordPress security flaws that allow attackers to upload malicious scripts or modify configuration files usually occur due to overly permissive permissions on your hosting directories. Keeping the default configuration of some automatic installers is the most exploited attack vector.

Quick Diagnostics

Cause

Overly permissive file permissions (e.g. 777) on WordPress files

Solution

Set secure permissions: find . -type d -exec chmod 755 {} \; and 644 for files

Cause

wp-config.php file accessible or writable by other server users

Solution

Set strict permissions on wp-config.php: chmod 600 wp-config.php

WordPress security flaws that allow attackers to upload malicious scripts or modify configuration files usually occur due to overly permissive permissions on your hosting directories. Keeping the default configuration of some automatic installers is the most exploited attack vector.

Step-by-Step Solution

1. 1

   Step 1: Establecer los permisos globales de forma segura por consola

   WordPress directories must belong to your web server user (such as www-data, apache, or nginx) and have a permission mask that prevents other users from writing to them:

   BASH Copy

   # Cambiar la propiedad de los archivos al usuario del servidor web
   sudo chown -R www-data:www-data /var/www/html/wordpress
   
   # Forzar a todas las carpetas a tener permisos 755
   find /var/www/html/wordpress -type d -exec chmod 755 {} \;
   
   # Forzar a todos los archivos a tener permisos 644
   find /var/www/html/wordpress -type f -exec chmod 644 {} \;
   

2. 2

   Step 2: Proteger al máximo el archivo crítico wp-config.php

   The wp-config.php file contains your database credentials and session security keys. Nobody except the web server and you should be able to read it:

   BASH Copy

   # Cambiar permisos de lectura exclusiva al dueño del archivo
   chmod 600 /var/www/html/wordpress/wp-config.php
   

3. 3

   Step 3: Proteger el archivo de reescritura .htaccess

   If you use the Apache web server, secure the route control file against plugin manipulations or malicious code injections:

   BASH Copy

   chmod 644 /var/www/html/wordpress/.htaccess