---
title: "Enabling write-access"
date: "2014-11-11"
category: "wordpress"
slug: "enabling-write-access"
---

## Overview

ApisCP uses a dual-user security model where the web server runs as a separate user from your account. This means WordPress cannot write to files on your account unless you explicitly grant permission to specific directories.

## Granting Write Access

Use [[writing-to-files]] to set the appropriate [[permissions-overview]] on the directories WordPress needs. The recommended directories are:

- **`wp-content/uploads/`**: Required for media uploads (change permissions recursively)
- **`wp-content/themes/`**: Required for in-browser theme editing (change permissions recursively)
- **`wp-content/plugins/`**: Required only if you want to edit plugins in-browser (change permissions recursively)

Apply the same process to any additional directories required by specific plugins or themes.

## Why Dual-User Security Matters

Traditional hosting runs PHP and site files under a single user. While convenient, this creates a significant security risk: any PHP exploit can be leveraged to modify _any_ file on your account. An attacker who gains access through a vulnerability can inject malicious code anywhere.

ApisCP's dual-user model limits this exposure. The web server can only write to directories you explicitly authorize. If a hacker exploits a vulnerability, they cannot modify files outside those permitted locations.

**Best practices:**

- Set permissions to `717` only on directories that WordPress actively needs to write to
- Do not apply write permissions broadly across all files -- doing so negates the security benefit
- Keep WordPress and all plugins up to date to minimize vulnerability exposure

## See Also

- [[writing-to-files]]
- [[open_basedir-restriction-messages]]
- [[permissions-overview]]
