WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I seem to be having issues with folder (and maybe file) permissions getting changed possibly by an FTP client. The WordPress install is using https. It started primarily with permissions in the wp-content/uploads folder not allowing anything to upload to the Media Library. Changing the uploads folder's permissions to 777 fixes this. Is there any risk in having the uploads folder and/or the entire wp-content folder permissions set to 777? I couldn't seem to find a clear answer at http://codex.wordpress.org/Changing_File_Permissions. Although I assume it changes from host to host.

share|improve this question

As listed down the bottom (http://codex.wordpress.org/Changing_File_Permissions#The_dangers_of_777) having 777 permissions allows anybody with know how to go in and modify and execute your code making it available to hackers.

I was reading an article yesterday and it stated that about 80% of all hacks came from uploading/inserting a file into the uploads folder creating a backdoor that they could use to steal information and lock you out etc. So while you may think "it's only my uploads directory" you are making it easier to do the most common hack on your site.

Sorry I can't find the source on my info, have an automatic history cleaner plugin.

EDIT: Found the reference: http://ottopress.com/2009/hacked-wordpress-backdoors/

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.
{"cc_re__cc_re__cc_by_sa_3_0": ["                    <li><a href=\"//area51.stackexchange.com\" title=\"proposing new sites in the Stack Exchange network\">Area 51</a></li>\r\n                        <li><a href=\"//careers.stackoverflow.com\">Stack Overflow Careers</a></li>\r\n                    \r\n                </ol>\r\n            </td>\r\n    </tr>\r\n</table>\r\n                </div>\r\n            </div>\r\n            <div id=\"copyright\">\r\n                site design / logo &#169; 2016 Stack Exchange Inc; user contributions licensed under <a href=\"https://creativecommons.org/licenses/by-sa/3.0/\" rel=\"license\">cc by-sa 3.0</a> \r\n                with <a href=\"http://blog.stackoverflow.com/2009/06/attribution-required/\" rel=\"license\">attribution required</a>\r\n            </div>\r\n            <div id=\"svnrev\">\r\n                rev 2016.5.23.3602\r\n            </div>\r\n                <div id=\"additional-notices\">\r\n                    WordPress is a trademark of the WordPress Foundation, registered in the US and other countries. This site is not affiliated with the WordPress Foundation in any way.\r\n         "], "copyright__copyright__copyright": ["ou may think \"it's only my uploads directory\" you are making it easier to do the most common hack on your site.\n\nSorry I can't find the source on my info, have an automatic history cleaner plugin.\n\nEDIT: Found the reference: http://ottopress.com/2009/hacked-wordpress-backdoors/\n\nshare|improve this answer\n\nYour Answer\n\n\u00a0\ndiscard\n\nBy posting your answer, you agree to the privacy policy and terms of service.\n\nNot the answer you're looking for? Browse other questions tagged or ask your own question."]}