title: File/folder permissions and ownership breaks wordpress functionality, what is a secure solution?
body: <p>I have a wordpress network running (on a shared host) to great satisfaction apart from a security dilemma.</p>
  
  <p>When I first installed the application, I did this through a plesk Cpanel.
  And later when I started to add plugins I realised the server used safe_mode On. I asked the host to remove it and they did but before this I did install most of my plugins through FTP because of permission problems due to the safe_mode On setting.</p>
  
  <p>But now I seem to be running into a different setting that is limiting me. Because I installed plugins through FTP, my FTP user is the owner of the files. Now when I try to update through the normal wordpress routine, it doesn't have sufficient permission for the stream folder and when I set this to 777 it has not enough permission for the plugin folders because apache is not the owner of the folders and files.</p>
  
  <p>I do not want to set all my folders to 777 (775 also doesn't work), changing owner (I tested with creating a folder through a Wordpress plugin) works, but <a href="http://codex.wordpress.org/Changing_File_Permissions" rel="nofollow">http://codex.wordpress.org/Changing_File_Permissions</a> tells me I shouldn't let apache be the owner of my files and folders.</p>
  
  <p>Could you advise me about:</p>
  
  <ul>
  <li>security issues with regards to letting apache be the owner of my files and folders</li>
  <li>security issues with regards to 777 permissions (I think this is obvious a security risk, but perhaps I'm overlooking something)</li>
  <li>are there other things I could do to make wordpress function normally</li>
  </ul>
  
  <p>If you need more information about the shared hosting, please let me know.</p>