To allow one-click updates on my site, I need to make the Craft 'app' folder writeable by the web server. Doesn't this present a security concern...to allow the actual php files of the application to be writeable by the web server?

2 Answers 2


Doesn't this present a security concern

Not in-and-of itself, but if a malicious user finds an exploit through another means, it does make it easier for them to drop their payload on the file system.

You can, of course, not make the craft/app folder writeable by Apache/PHP and just do manual updates. Or better yet, do the auto-updates on development or staging boxes (so you can properly test) and deploy to production where auto-updates are disabled.

  • 1
    +1 for disallowing auto-updates in production. Update locally, deploy to production, run any "finish up" tasks on production.
    – Lindsey D
    Commented Jul 12, 2016 at 19:41
  • Thank you. I plan to do manual updates, but still wondered about this approach.
    – userAW
    Commented Jul 12, 2016 at 20:19

Security is not off or on, it's layers of an onion. Anything you do has to factor into the bigger picture.

My layers include:

  • What user does the web server run as? What user is your content? Your web server should never be the same as the user who owns the files, typically www-data, www, apache, etc. Also, don't run apache as the user nobody.
  • Are you using PHP-FPM, su-PHP, fastcgi, or Apache w/ mod_PHP baked in? I prefer fpm since you can run every website as a separate pool and separate PHP ini / open_basedir configs, increasing security. If a site gets hacked, only that pool is affected.
  • What are the permissions of the folders/files? Shouldn't ever be 777, ideally 750 for directories and 640 for files. The web server should be added to the user's group and given read permissions (so it can only access static files).
  • Who else has access to the server? Deploy users via SSH, (s)FTP, MySQL replication users, etc. Limit access to need-to-know.

Just to play devil's advocate, if you do disable the one-click updates in production, that also makes it harder to simply update, which could be worse than not updating at all. I've seen well-meaning WP Devs tend to fall into this trap, keeping their client's sites in a sort-of cryogenic state. While Craft is not as widely used, the same security precautions apply.

I'm reminded of Brad's post about security here:

Perhaps the biggest thing Craft has going for it, in the event a security related bug is that we can get the fix deployed quickly to our users with Craft's one-click auto-updating. In addition to that, we can mark a release as "critical", which gets special attention in the control panel.

Craft probably needs to eventually write files to the server anyway, including cache files, and assets, so unless you're shutting off access there as well, I'd wager it's the same risk—maybe even more so—because asset files/uploads tend to be in the web root unless you do some file aliasing.

And without question, if you're not backing up your database and filesystem regularly, you're asking for trouble. Let's assume you are hacked. If you don't have good back-ups, whether auto-update is on or off is not going to help you.

  • 1
    As always, a way better answer than mine from @RitterKnight.
    – Brad Bell
    Commented Jul 12, 2016 at 20:22
  • I think there's always room for brevity too ;) Commented Jul 12, 2016 at 20:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.