3 ms·
> It can even install its own plugins, if you give it the credentials to FTP to the server which hosts it. If it's asking for FTP credentials, you need to fix
by csixty4 12y ago
> It can even install its own plugins, if you give it the credentials to FTP to the server which hosts it.
If it's asking for FTP credentials, you need to fix your file permissions[1]
[1] http://codex.wordpress.org/Changing_File_Permissions
- falcolas 12y agoHere's the problem with that - most of these recommendations are for convenience, and tend to run counter to security recommendations. Files and directories on a web server should never be owned by or writable by the web user. They typically don't need to be world readable either (if they are, and your web server is compromised, then you start to leak a lot of unrelated data out over the compromised service). Here's a pretty minimalistic list of recommendations worth looking at on properly securing a web server: http://resources.infosecinstitute.com/securing-linux-web-server/ http://resources.infosecinstitute.com/securing-linux-web-ser...
- csixty4 12y agoYep. Welcome to administering systems for a web site. There's always a trade-off between convenience & security. If you make it hard for people to install plugins, they're not going to use your software (or your server). If you add "define('DISALLOW_FILE_MODS', true);" to wp-config.php, it removes the ability to install themes & plugins through WordPress itself. Then it's more like a traditional web application.