---
title: "Writing to files"
date: "2014-10-28"
category: "php"
slug: "writing-to-files"
---

PHP runs as a separate user from your account to enhance server security. This means that PHP cannot write to files unless explicit write permissions are granted. Applications like WordPress and Drupal may display a _Permission Denied_ error when attempting to write:

> **Warning**: fopen(<filename>) [function.fopen]: failed to open stream: Permission denied in **<filename>** on line **1**

## Solution

Grant write access ([[permissions-overview]]) selectively to the specific files and folders your application needs to write to. Permissions can be modified in the control panel under **Files** > **File Manager** > **Properties**.

> Permissions can be applied recursively to reduce the number of steps, but be aware that anywhere a web application can write, an attacker can also write if your site is compromised. Grant write access only to directories where file uploads occur, and install plugins manually when possible to reduce exposure.

Files created by the web server can be managed immediately through **File Manager** or by FTP the following day after nightly housekeeping completes.

## Why PHP Runs as a Separate User

Traditionally, PHP and site files run under the same user for simplicity. However, this creates a significant security risk: any HTTP request -- legitimate or forged -- can be leveraged by an attacker. If a PHP exploit is discovered [[1](http://www.cvedetails.com/vulnerability-list/vendor_id-74/product_id-128/PHP-PHP.html)][[2](https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=wordpress)][[3](http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=drupal)][[4](http://www.cvedetails.com/vulnerability-list/vendor_id-5025/Zend.html)][[5](http://www.cvedetails.com/vulnerability-list/vendor_id-3496/product_id-6129/Joomla-Joomla.html)], an attacker can modify any file accessible to PHP, inject bootloaders, and upload malicious scripts.

By running PHP as a separate user, only files you explicitly grant write access to can be modified. If an attacker cannot modify a file, they cannot inject malicious code.

**Best practice:** Set permissions to 717 only on directories and files that are regularly updated by the application. Do not apply these permissions broadly, as this negates the security benefit.

## See Also

- [[permissions-overview]]
