Understanding permissions for wordpress

Question

I am currently trying to set up a wordpress site on my own personal raspberry pi server, which I'll eventually put online. I've been doing my best to try and understand the security of all the wordpress files, but I am unsure if I have been getting it.

Should my user (pi) be given permission to add/edit the wordpress files? The tutorial explicitly had me give all the permissions to the apache user, which I think I understand but I cannot change the actual permission numbers on any of the files/directories. I tried adding myself to the apache users group, but I still could not add/edit files. I originally tried to add a php.ini file using the command line and sudo, is that the only way the "pi" user should be allowed to interact with it? This seems pretty cumbersome to me, and I cannot add anything more than simple text files to it, so I am unsure how I would add a theme (this whole problem arose because a theme I want to add is above the upload size limit of 2mb, which I have been trying to chnage as well with no luck through php.ini or .htaccess).

Any overall explanation of permissions and what permissions I should be giving the "pi" user or how to do so would be greatly appreciated. (Also i chnaged the default password for pi and plan to change the username before making it live). Thank you

Answer 1

WordPress is basically designed to run on a server where a shell user such as pi never changes files. Everything about adding / updating / editing files is done by the WordPress code itself, when you the admin install plugins, upload media, edit theme stylesheets and the like. That's why the files are owned by apache . Lots of WordPress instances run on shared servers, so security is enhanced by this convention.

But you want your shell user to fiddle about with your files. The easiest way to do that is with the apache user. You can become that user with sudo su apache .