我认为下面的规则是推荐的默认wordpress网站:

对于wp-content中的文件夹，设置0755权限: chmod -R 0755插件 chmod -R 0755上传 chmod -R 0755 upgrade 让apache用户成为wp-content目录的所有者: Chown apache上传 Chown apache升级 Chown apache插件

chown -Rv www-data:www-data
chmod -Rv 0755 wp-includes
chmod -Rv 0755 wp-admin/js
chmod -Rv 0755 wp-content/themes
chmod -Rv 0755 wp-content/plugins
chmod -Rv 0755 wp-admin
chmod -Rv 0755 wp-content
chmod -v 0644 wp-config.php
chmod -v 0644 wp-admin/index.php
chmod -v 0644 .htaccess

将所有wp文件的完全访问权限授予www-data用户(在这种情况下是web服务器用户)可能是危险的。 所以最好不要这样做:

chown www-data:www-data -R *

然而，当你安装或升级WordPress及其插件时，它会很有用。但是当你完成后，让web服务器拥有wp文件就不再是一个好主意了。

它基本上允许网络服务器在你的网站上放置或覆盖任何文件。 这意味着如果有人设法使用web服务器(或一些.php脚本中的安全漏洞)在您的网站中放置一些文件，就有可能接管您的网站。

为了保护您的网站免受此类攻击，您应该采取以下措施:

All files should be owned by your user account, and should be writable by you. Any file that needs write access from WordPress should be writable by the web server, if your hosting set up requires it, that may mean those files need to be group-owned by the user account used by the web server process. / The root WordPress directory: all files should be writable only by your user account, except .htaccess if you want WordPress to automatically generate rewrite rules for you. /wp-admin/ The WordPress administration area: all files should be writable only by your user account. /wp-includes/ The bulk of WordPress application logic: all files should be writable only by your user account. /wp-content/ User-supplied content: intended to be writable by your user account and the web server process. Within /wp-content/ you will find: /wp-content/themes/ Theme files. If you want to use the built-in theme editor, all files need to be writable by the web server process. If you do not want to use the built-in theme editor, all files can be writable only by your user account. /wp-content/plugins/ Plugin files: all files should be writable only by your user account. Other directories that may be present with /wp-content/ should be documented by whichever plugin or theme requires them. Permissions may vary.

来源及其他信息:http://codex.wordpress.org/Hardening_WordPress

这实际上取决于你打算使用的插件，因为有些插件会改变wordpress的根文档。但一般来说，我推荐这样的wordpress目录。

这将分配“根”(或任何你正在使用的用户)作为每个文件/文件夹的用户，R意味着递归，所以它不会停止在“html”文件夹。如果你没有使用R，那么它只适用于“html”目录。

sudo chown -R root:www-data /var/www/html  

这将设置“wp-content”的所有者/组为“www-data”，从而允许web服务器通过管理面板安装插件。

chown -R www-data:www-data /var/www/html/wp-content

This will set the permission of every single file in "html" folder (Including files in subdirectories) to 644, so outside people can't execute any file, modify any file, group can't execute any file, modify any file and only the user is allowed to modify/read files, but still even the user can't execute any file. This is important because it prevents any kind of execution in "html" folder, also since the owner of the html folder and all other folders except the wp-content folder are "root" (or your user), the www-data can't modify any file outside of the wp-content folder, so even if there is any vulnerability in the web server, and if someone accessed to the site unauthorizedly, they can't delete the main site except the plugins.

sudo find /var/www/html -type f -exec chmod 644 {} +

这将限制具有rw-r-----这些权限的用户/组访问“wp-config.php”的权限。

chmod 640 /var/www/html/wp-config.php

如果一个插件或更新抱怨它不能更新，然后访问SSH并使用这个命令，并通过管理面板授予“www-data”(web服务器)更新/安装的临时权限，然后在完成后恢复到“根”或您的用户。

chown -R www-data /var/www/html

在Nginx中(apache的过程相同)保护wp-admin文件夹免受未经授权的访问和探测。即使你安装了nginx，也需要Apache2-utils来加密密码，如果你计划在同一个文件中添加更多用户，请省略c。

sudo apt-get install apache2-utils
sudo htpasswd -c /etc/nginx/.htpasswd userName

现在参观这个地方

/etc/nginx/sites-available/

使用此代码保护带有密码的“wp-admin”文件夹，现在如果您试图访问“wp-admin”，它将询问密码/用户名。注意，这里你用了"。“Htpasswd”文件，包含加密后的密码。

location ^~ /wp-admin {
    auth_basic "Restricted";
    auth_basic_user_file /etc/nginx/.htpasswd;
    index  index.php index.html index.htm;
}

现在重新启动nginx。

sudo /etc/init.d/nginx restart

文件的正确权限是644 文件夹的正确权限为755

要更改权限，请使用terminal和以下命令。

find foldername -type d -exec chmod 755 {} \;
find foldername -type f -exec chmod 644 {} \;

文件夹是755，文件是644。

对于那些在主文件夹下有wordpress根文件夹的用户:

apache Ubuntu * * /

将您的用户添加到www-data组:

CREDIT赋予www-data组写权限

你想在你的用户上调用usermod。那就是:

sudo usermod -aG www-data yourUserName

**假设www-data组存在

检查用户是否在www-data组: 组yourUserName

你应该得到这样的东西:

youUserName : youUserGroupName www-data

** youUserGroupName通常与您的用户名类似

递归地更改wp-content文件夹的组所有权，保持用户所有权 chown username:www-data -R youWebSiteFolder/wp-content/* 修改目录为“youWebSiteFolder/wp-content/” cd youWebSiteFolder / wp-content 递归更改文件夹和子文件夹的组权限以启用写权限: 找到。-type d -exec chmod -R 775 {} \;

/home/yourUserName/youWebSiteFolder/wp-content/的模式从0755 (rwxr-xr-x)更改为0775 (rwxrwxr-x)

递归地更改文件和子文件的组权限以启用写权限: 找到。-type f -exec chmod -R 664 {} \;

结果应该如下所示:

WAS:
-rw-r--r--  1 yourUserName www-data  7192 Oct  4 00:03 filename.html
CHANGED TO:
-rw-rw-r--  1 yourUserName www-data  7192 Oct  4 00:03 filename.html

等价于:

chmod -R ug+rw文件夹

文件的权限是664，目录的权限是775。

附注:如果有人在更新插件时遇到“无法创建目录”错误，请: server@user:~/domainame.com$ sudo chown用户名:www-data -R wp-content 当你在你的域的根。 假设:wp-config.php有 LocalHost上的FTP凭据 定义(“FS_METHOD”、“直接”);