hack victim

[TlemcenW]

today i got hacked too, thanks to Mintcold he helped me, or actually, he did solved the problem, i just wanna ask here, what are the directories on wp that should be 666 or 755
not 777

thanks for u all

TlemcenW Reviewed by TlemcenW on 11th Nov 2011. hack victim today i got hacked too, thanks to Mintcold he helped me, or actually, he did solved the problem, i just wanna ask here, what are the directories on wp that should be 666 or 755 not 777 thanks for u all Rating: 5

[CuraHack]

All directories should be 644 with an exception for the temp. directories.

[TlemcenW]

thanks will do it

[Drinkordie]

http://codex.wordpress.org/Changing_File_Permissions

Permission Scheme for WordPress
Permissions will be different from host to host, so this guide only details general principles. It cannot cover all cases. This guide applies to servers running a standard setup (note, for shared hosting using "suexec" methods, see below).

Typically, all files should be owned by your user (ftp) account on your web server, and should be writable by that account. On shared hosts, files should never be owned by the webserver process itself (sometimes this is www, or apache, or nobody user).

Any file that needs write access from WordPress should be owned or group-owned by the user account used by the WordPress (which may be different than the server account). For example, you may have a user account that lets you FTP files back and forth to your server, but your server itself may run using a separate user, in a separate usergroup, such as dhapache or nobody. If WordPress is running as the FTP account, that account needs to have write access, i.e., be the owner of the files, or belong to a group that has write access. In the latter case, that would mean permissions are set more permissively than default (for example, 775 rather than 755 for folders, and 664 instead of 644).

The file and folder permissions of WordPress should be the same for most users, depending on the type of installation you performed and the umask settings of your system environment at the time of install.

NOTE: If you installed WordPress yourself, you likely do not need to modify file permissions. Unless you are experiencing problems with permission errors, or you want to, you probably should not mess with this.
Template:Note 2

Typically, all core WordPress files should be writable only by your user account (or the httpd account, if different). (Sometimes though, multiple ftp accounts are used to manage an install, and if all ftp users are known and trusted, i.e., not a shared host, then assigning group writable may be appropriate. Ask your server admin for more info.) However, if you utilize mod_rewrite Permalinks or other .htaccess features you should make sure that WordPress can also write to your /.htaccess file.

If you want to use the built-in theme editor, all files need to be group writable. Try using it before modifying file permissions, it should work. (This may be true if different users uploaded the WordPress package and the Plugin or Theme. This wouldn't be a problem for Plugin and Themes installed via the admin. When uploading files with different ftp users group writable is needed. On shared hosting, make sure the group is exclusive to users you trust... the apache user shouldn't be in the group and shouldn't own files.)

Some plugins require the /wp-content/ folder be made writeable, but in such cases they will let you know during installation. In some cases, this may require assigning 755 permissions. The same is true for /wp-content/cache/ and maybe /wp-content/uploads/ (if you're using MultiSite you may also need to do this for /wp-content/blogs.dir/)

Additional directories under /wp-content/ should be documented by whatever plugin / theme requires them. Permissions will vary.

[nEw_boY]

Check for Addon called BPS > Bullet Proof Security.
It will analyze all directory and will point out wrong set of permissions.

[Melder]

Just a question: what host are you using? And what's the plan (vps, shared, dedicated?)

Anyway, keep your wordpress plugins updated.

[nba517]

777 always dangerous! make it read only