When people talk about WordPress security, file permissions and ownership are usually the last thing on their minds. Installing security plugins is a good practice and a must for every WordPress website. However, if your file-system permissions aren’t set up correctly, most of your security measures could be easily bypassed by intruders.

Permissions and ownership are quite important in WordPress installations. Setting these up properly on your Web server should be the first thing you do after installing WordPress. Having the wrong set of permissions could cause fatal errors that stop your website dead. Wrong permissions can also compromise your website and make it prone to attacks.

Aside from the security concerns, a number of other issues can stem from having the wrong set of permissions and ownership. Have you ever encountered a blank white screen when trying to load your website for the first time? Or have you ever received error messages when trying to upload images in the media uploader? Correcting permissions and ownership of your files and folders will often fix these types of problems.

In this article, we will teach you all about WordPress filesystem permissions and ownership: what they are, why they are important and how to set them up. You will learn a few basic principles that I follow to keep my file system intact. We will also cover the two most common WordPress server configurations. We’ll explain how they differ and, more importantly, how to set the proper permissions and ownership for each.

Terminal Vs. FTP Client

During the course of this article, we will be using the terminal to change permissions and ownership. Why not use an FTP client instead? The reason is that FTP is a bit limited for our needs. FTP can be used to transfer files and change file and folder permissions, but it cannot be used to change ownership settings.

To perform the commands listed in this article, you will have to be logged into your server using the SSH command. If you are not familiar with the terminal and SSH, you can learn about them in the article “Introduction to Linux Commands.”

Users And Groups

Before anything else, we need to quickly talk about what users and groups are, because these go hand in hand when defining permissions.

To put it simply, a user is an account that has access to the computer, and a group just is an identifier for a certain set of users. This means that every time you transfer files using FTP, you are using a user account on your server. And depending on how your host has set up your account, you (the user) might belong to one or more groups. Users and groups are like users and roles in WordPress. Both are conceptually the same, except that the former is used on your server.

Users and groups are important because they help to identify privileges for all of our files and folders. Owners of a file normally would have full privileges on it; other users who belong to the same group would have fewer privileges on it; while everyone else might have no privileges on it. These privileges are what we call permissions.

What Are File Permissions?

Permissions dictate what users can do with a file. A permission is represented by a set of numbers, such as 644 or 777, referred to as a permission mode. If you have used plugins in WordPress before, then you’ve most likely been asked by some of them to change the permissions of a file or directory because the plugin can’t write to it. By changing the file’s permissions, you are allowing the Web server to gain access to that file or folder.

Think of a permission mode as a set of “who can do what” statements, in which each digit corresponds to the “who” part of the statement:

• First digit
  What the user of the account that owns the file can do
• Second digit
  What other user accounts in the owner’s group can do
• Third digit
  What the user accounts of everyone else (including website visitors) can do

Next, the number corresponds to the “what” part of the statement and is a sum of a combination of any these digits:

• 4
  Read a file, or read the names of the files in a folder
• 2
  Write or modify a file, or modify the contents of a folder
• 1
  Execute or run a file, or access the files in a folder

These digits are the privileges that are assigned to the “who” in the permission mode. Note in the list above that privileges mean something different for files and folders.

Using the correct permission mode is quite important. To better illustrate this, think again of users and roles in WordPress. On a WordPress website, contributors and administrators have different sets of capabilities. Contributors may create new blog posts, but they may not add plugins. Administrators, on the other hand, may add plugins and also create blog posts. Administrators may even change the look of the website if they want to. A clear line separates what users in different roles can do. This is the same with permission modes, except that instead of dealing with blog posts and theme options, we are dealing with files and folders on the server.

Changing Permission Modes

FTP clients usually provide an interface where you can conveniently change the permission mode of your files and folders. Here’s a screenshot of the interface in my FTP client:

Example of a permission mode interface.

If you have access to your server’s terminal, you can also use the chmod command to change the permission mode of a file or folder:

sudo chmod 644 <file>
    

To change the permission modes of all files or folders, use chmod in tandem with the find command. For example, you can use this to change all files to 644:

sudo find . -type f -exec chmod 644 {} +
    

Or use this to change all of your folders to 755:

sudo find . -type d -exec chmod 755 {} +
    

Refer to “Changing File Permissions in the WordPress Codex” for a guide to changing permission modes.

The Difference Between 644 And 777

Let’s look at some permission modes and how they affect our website.

What would a PHP script with a permission mode of 644 mean? Following the explanation above of how permission modes work, we can decipher what this mode allows users to do with our script:

• The owner’s privileges are “read” (4) + “write” (2) = 6
• The owner’s group privileges are “read” (4) = 4
• Everyone else’s privileges are “read” (4) = 4

In plain language, this means that:

• if we own the script, we may read and modify it;
• everyone else may only read it.

As we can see, 644 is a good permission mode for our PHP script. We can make changes to it, and our Web server can read it.

Now let’s look at folders. What if we owned a folder that had a permission mode of 777? This permission mode can be broken down as follows:

• The owner’s privileges are “read” (4) + “write” (2) + “execute” (1) = 7
• The owner’s group privileges are “read” (4) + “write” (2) + “execute” (1) = 7
• Everyone else’s privileges are “read” (4) + “write” (2) + “execute” (1) = 7

This means that

• anyone may get a list of file names in our folder;
• anyone may create, modify and delete any file in our folder;
• anyone may access the files in our folder.

It is obvious that 777 is a bad permission mode for anything on our WordPress website because any visitor would be able to add files to our directory or even delete scripts. Worse, anyone would be able to put in malicious code and compromise our website.

WordPress Server Configurations

Now we know about permissions and how to read them. But before proceeding to change all of our permissions, we need to understand how our server is set up. Because permissions deal with user accounts and groups, we need to know how our WordPress website runs.

A lot of different server configurations are out there. Different configurations need different sets of permission modes for WordPress to work correctly and securely. We’ll talk about just the two most common configurations and the proper permissions for them:

• Standard server configuration:
  • You have a user account.
  • Your Web server runs as another user account.
• Shared server configuration or suEXEC configuration:
  • You have a user account.
  • Other people who use the server have user accounts and might share the same group with your user account.
  • Your Web server runs as the owner of your WordPress files.

The main difference between these two is in how the Web server runs.

Permissions For A Standard WordPress Server Configuration

Standard WordPress configurations require a bit more work than shared server configurations because the Web server has no relationship to our user account.

File and Folder Ownership for WordPress

First, we need to adjust the file and folder ownerships of our WordPress files. We’ll have to make sure of the following:

• that your user account is the owner of all WordPress files and folders,
• that your user account and the Web server’s user account belong to the same group.

To find out the groups that your user account belongs to, you can use this command in your server’s terminal:

groups
    

Then, to find out the groups that your Web server belongs to, you can temporarily insert this PHP snippet in one of your WordPress scripts:

echo exec( 'groups' );
    

If your user and the Web server don’t belong to the same group, you can use the following command in the terminal to add your user to one of your Web server’s groups:

sudo usermod -a -G <a-common-group-name> myuser
    

Lastly, to ensure that everything in our WordPress folder belongs to our user account and has the shared group that we just added, perform this command in your WordPress folder:

sudo find . -exec chown myuser:a-common-group-name {} +
    

Permissions for WordPress

All of our files and folders should now have the correct ownership. Now it’s time to adjust the permission modes. To make things simpler, you’ll only need to remember the following:

• All files should be 664.
• All folders should be 775.
• wp-config.php should be 660.

Here’s what we’re trying to achieve with this set of permission modes:

• Our user account may read and modify our files.
• WordPress (via our Web server) may read and modify our scripts.
• WordPress may create, modify or delete files and folders.
• Other people may not see our database credentials in wp-config.php.

You might be thinking that allowing WordPress full privileges with our folders is not secure. Don’t worry — we’re doing this because WordPress needs certain features to create and modify files. WordPress allows us to upload and remove themes and plugins and even edit scripts and styles from the administrative back end. Without this type of permission, we would have to manually upload themes and plugins every time using FTP.

You can use your FTP client to change the permission modes, or you can use the following commands in your WordPress directory to quickly adjust the permissions of all of your files and folders:

sudo find . -type f -exec chmod 664 {} +
    sudo find . -type d -exec chmod 775 {} +
    sudo chmod 660 wp-config.php
    

Note that some Web servers are stricter than others. If yours is strict, then setting your wp-config.php to 660 might stop your website from working. In this case, just leave it as 664.

Permissions For A Shared Server Configuration Or SuEXEC Configuration

Permissions for shared server configurations are easier to implement. We won’t dwell on ownership because the Web server runs as the owner of our files and folders. Because our user account and the Web server share the same permissions (both are owners), we can dive right into modifying the permission modes:

• All files should be 644.
• All folders should be 755.
• wp-config.php should be 600.

Similar to the previous set of permission modes, these break down as follows:

• Our user account may read and modify our files.
• WordPress (via our Web server and as the account owner) may read and modify our scripts.
• WordPress may create, modify or delete files or folders.
• Other people may not see our database credentials in wp-config.php.

Again, you can use an FTP client to change the permission modes, or you can use the following commands in your WordPress directory to quickly adjust the permissions of all of your files and folders:

sudo find . -type f -exec chmod 644 {} +
    sudo find . -type d -exec chmod 755 {} +
    sudo chmod 600 wp-config.php
    

Similar to the standard WordPress server configuration, your server might be stricter than others and might not allow wp-config.php to be 600. In this case, you can adjust it to a more lenient 640; if that still doesn’t work, then use 644.

Always follow these guidelines and your WordPress files should be kept safe from intruders.

Common Pitfalls

A common mistake people make is to set the uploads folder to 777. Some do this because they get an error when trying to upload an image to their website, and 777 quickly fixes this problem. But never give unlimited access to everyone, or else you’ll make the Web server vulnerable to attack. If you follow the guidelines covered in this article, then you should have no problems uploading files to your website.

At times, though, a plugin will request that you set a file to 777. On these occasions, you can temporarily set it to 777, but make sure to set it back to its original permission mode when you’re done.

Conclusion

We’ve learned now about the proper permissions and file ownership of a WordPress website. We’ve also learned to avoid a permission mode of 777 because of how it endangers the Web server.

Hopefully, you can implement these tips to keep your WordPress website safe and secure. If you have any additional tips regarding permissions and security, please share them in the comments below.

Excerpt image credit: Christopher Ross

(al, ml)

The post Proper WordPress Filesystem Permissions And Ownerships appeared first on Smashing Magazine.

Trends come and trends go. The ones that stick around the longest do so because they solve a particular problem. A trend that’s popular right now for that very reason, is sticky elements; elements that behave normally until we scroll, and then maintain their presence on the page somehow.

The trend started with sidebars, but where it’s really grown in popularity is headers. Why? Because headers tend to contain navigation, and persistent navigation is popular with users.

In this tutorial we’ll create a header that sticks to the top of the viewport, but so that it doesn’t interfere with the content, we’re going to minimize it when the user scrolls down the page.

Here’s what it’s going to look like when we’re done:

If you’d like to follow along with the code, you can download it here.

The HTML

The HTML for our example is really simple, all we need is an h1 inside a header. Below that we have an image to force the page to scroll so that we can test the effect.

<header><h1>Sticky Header</h1></header> <img src="large-image.jpg" width="782" height="2000" alt="Big Image" />

The jQuery

CSS transitions are the best way of handling the animation portion of our sticky header. All we’re using jQuery for is detecting the scroll position of the window.

When the scroll position of the window is greater than 1—meaning that the user has scrolled downwards—then we want to add the class ‘sticky’ to the header; otherwise we want to remove it (if it’s there).

This means we’ll be able to style the header based on whether the ‘sticky’ class is applied.

$(window).scroll(function() { if ($(this).scrollTop() > 1){ $('header').addClass("sticky"); } else{ $('header').removeClass("sticky"); } });

The important thing to note is that using jQuery in this way degrades gracefully; if JavaScript is disabled, the navigation will still work, the header will simply be styled in the non-sticky default state.

The CSS

Our CSS is used to style the two different states, the default state, and the ‘sticky’ state; and to transition between the two states.

To start with, let’s add some simple styles that improve the look of the header:

header{ position: fixed; width: 100%; text-align: center; font-size: 72px; line-height: 108px; height: 108px; background: #335C7D; color: #fff; font-family: 'PT Sans', sans-serif; }

Now for the fun part: when the user scrolls down, the ‘sticky’ class will be applied, and we can now style the header differently to reflect that new priority on the page. We also set the position to fixed, so that we’re not changing positioning mid-scroll.

There are several things we want to do: first, we want to change the size so that it uses up less screen space; we also want to change the color and align to the left so that visually it doesn’t interfere too much:

header.sticky { font-size: 24px; line-height: 48px; height: 48px; background: #efc47D; text-align: left; padding-left: 20px; }

Naturally, what you do here will depend on the design you’re trying to achieve. You can do just about anything you like.

If you test this now, you’ll see that the header changes as soon as we scroll down.

Now, to animate the change, all we need to do is set a transition on the header, like so:

transition: all 0.4s ease;

Conclusion

Creating this animated header with CSS3 properties and toggling the class with jQuery is extremely simple and adds a ton of UX goodness to your site design.

What’s more, the code degrades gracefully, so there really is no downside to the implementation.

17 HTML5 Responsive Galleries & Components Bundle – only $37!

Is getting a college degree is a waste of time?

Let’s look at some numbers:

• 71% of college students borrow money for school
• Today, there is approximately $1 trillion of outstanding student debt in the U.S. 
• Average student debt: $29,400

This leaves many scratching their heads. Is college worth the cost? Well, college grads, ages 25 to 32, make $17,500 more annually than their peer who have a high school diploma.

While some fields of study do not require a college degree, it is generally agreed that those with degrees make more money. 

College analysts are now asking a new question- Does it matter where one gets her or his degree? 

A new Gallup poll answers that question with an overwhelming no. Not at all. 

In a survey of 29,650 college graduates, Purdue University asked graduates questions relating to their income or engagement at work. 

Here are some of the results:

• 39% of college graduates feel “engaged” at work (10 points higher than whole U.S. population)
• “Engagement” in work did not vary in terms of where one received her or his degree
• There is no link between cost of college diploma and later income. (It is much more dependent on one’s field of study)
• 2% of graduates with debt between $20,000-$40,000 stated they were “thriving”
• Higher levels of “engagement” at work were reported for those who attended schools with 10,000 students or more. Private for-profit schools saw worse outcomes.

It’s true- the pride of receiving an acceptance letter from an Ivy or stating a prestigious alma-mater cannot be captured in a poll. But when you look at the data, it’s the student that determines her or his success, not the institution.

Now we’ll leave you with a bit of advice from Brandon Busteed, leader of Gallup’s education work:

“If you can go to Podunk U debt free vs. Harvard for $100,000, go to Podunk. And concentrate on what you do when you get there.” 

It’s your turn to chime in. What is the value of a college degree? Does it matter where you get it?

Walk-In Hours

Need assistance with a resume, cover letter, or have quick questions? Stop by during our walk-in hours!

Hours

·      We offer 15-minute walk-in appointments Monday-Friday from 2-4 PM for quick resume critiques, on-the-spot job search advice, and an overview of services.

·      Please bring a hard copy of your resume and/or cover letter for review, upload the document to UMBCworks or have it accessible using the Internet so you can print the document at our office. Walk-in appointments are taken in our main office, Math/Psych 212, on a first-come, first-served basis with the last walk-in taken at 3:45PM.

·      We also offer assistance with resumes, cover letters, and quick questions in The Writing Center on the first floor of the Albin O. Kuhn Library on Wednesdays and Thursdays from 6-8 PM.

·      If you are not available during these hours, you can schedule an appointment: online using UMBCworks, call our office (410-455-2216), or stop by our office (Math/Psyc 212)

The Resume: Your 15-Second Chance to an Interview

·      If you are applying for internships or jobs, you will need a well crafted resume. Carefully crafted resumes are your key to obtaining invitations to interviews. Resumes should be tailored to the positions for which you are applying.

·      Employers use resumes to judge qualifications and skills as they relate to the available position.

·      A resume can be considered a brief commercial. The goal of a resume is to convince the reader to invest in what you have to offer.

·      Parts of a Resume: Contact Information, Objective, Education, Course Projects, Work Experience, Special Skills and Training, Professional Memberships, Publications, Presentations, Activities, Military History, Honors/Awards, Travel/Study Abroad Interests

For samples and more information:

View Pages 10-17 of the Career Development Guide: http://careers.umbc.edu/skills/guide.pdf

and http://www.careers.umbc.edu/skills/resume/. 

Additional samples can also be found on our Career Paths website (http://www.umbc.edu/careerpath/)

Cover Letters

·      A cover letter is required whenever you are not present to personally introduce your resume, unless the employer specifically states that they do not want cover letters.

·      Employers want to see how you are able to communicate through the written word and this is your first opportunity to show them your abilities and to make the best first impression possible.

·      The cover letter provides you with the opportunity to introduce yourself, express your interest in a position, offer extra, and show your personality.

·      Parts of a Cover Letter: Why You’re Writing, Why Hire Me, Next Steps

For samples and more information:

View pages 21-22 of the Career Development Guide: http://careers.umbc.edu/skills/guide.pdf

http://my.umbc.edu/groups/careers/news/42276

http://www.careers.umbc.edu/skills/coverletter/ 

If you need help with getting ready for your job search, don’t hesitate. Stop by Career Services today. We’d love to see you there.

To: The UMBC Community
From: Provost Philip Rous

I am delighted to announce the appointment of Dr. Julia Ross as Dean of the College of Engineering and Information Technology (COEIT). Dr. Ross will begin her new role on August 4, 2014. Dr. Ross’s appointment brings to a successful conclusion a national search that was begun at the start of this academic year.

Dr. Ross received her Ph.D. from Rice University and joined UMBC’s faculty in 1995. Dr. Ross is currently the Constellation Professor of Information Technology and Engineering and professor of chemical, biochemical and environmental engineering. From 2006 to 2013, Dr. Ross served as chair of her department and one of her many accomplishments was a successful merger of two academic programs to form the Department of Chemical, Biochemical and Environmental Engineering. Most recently, Dr. Ross served as Special Assistant to the Provost for Inter-Institutional Research Initiatives and has been instrumental in enhancing research relationships and collaborations between UMBC and the University of Maryland, Baltimore, including the development of the UMB-UMBC seed grant program.

Dr. Ross has a distinguished record of scholarship in the field of bioengineering and engineering education, and is the author or co-author of over 50 peer-reviewed publications and the K-12 INSPIRES Curriculum. Since joining UMBC, she has been awarded nearly $7 million in external grants as PI to support her research. In 2008 Dr. Ross was elected as a fellow of the American Institute of Medical and Biological Engineering, and in 2013 she received the prestigious American Council on Education fellowship, the nation’s premier higher education leadership development program preparing senior leaders to serve American colleges and universities. Dr. Ross is known for her commitment to shared governance and for advancing opportunities for women and underrepresented minorities in engineering and information technology.

As dean of COEIT and as a member of UMBC’s senior leadership team, Dr. Ross will advance the mission of the university and the college by building strategically upon its strengths in the research and scholarly achievement of faculty, graduate and undergraduate students, while supporting continued success and excellence in the teaching and service missions of the college’s academic departments and programs. Dr. Ross will develop and promote activities that support and build a diverse faculty, and oversee faculty recruitment and development, promotion and tenure, and the appointment of department chairs and center directors. Dr. Ross will identify, develop, expand and sustain public and private partnerships and sources of research and extramural funding. She will collaborate with on-campus and off-campus partners and stakeholders to identify and engage in innovative strategies to strengthen research activity and infrastructure, technology transfer, venture creation and other economic development initiatives. She will also represent the interests of the college and the university to various constituencies both inside and outside of the UMBC community, and participate in campus-wide shared governance processes.

On behalf of the entire UMBC community I would like to express my sincere appreciation for the dedication and commitment of the members of the search committee, under the outstanding leadership of Professor Anupam Joshi, and for the contributions to this process made by our faculty, staff and students. UMBC is very fortunate to have someone of Dr. Julia Ross’s impressive experience and talent to serve as our next Dean of the College of Engineering and Information Technology. Please join me in congratulating her.

Learn more about Dr. Ross.