How to find world-writable files on your server
FTP by Zaweba's Disk lens lists world-writable files and folders on your hosting, and Permissions sets them back to safer modes such as 644 and 755.
Scan the site with Disk in FTP by Zaweba and switch the list to the web-server lens. World-writable files and folders are flagged there as security problems, near the top, each with a short reason. Tag them, open Permissions and set a safer mode, with 644 for files and 755 for folders being the recommended preset.
World-writable means anyone with an account on the server can change the file, which on shared hosting can be a lot of people. You will often see it written as 777 for folders or 666 for files. It tends to creep in when someone has followed an old tutorial that said "just set it to 777" to make an upload folder work, and then never set it back.
Why it matters
A writable file is an invitation. If any other site or script on the same server is compromised, a world-writable PHP file in your site is somewhere it can put its own code. A world-writable folder is somewhere it can drop new files. Most of the time nothing happens, but it is a weakness you can close in a few minutes.
Finding them
Connect to the site and open Disk from the toolbar or the Site menu. Let the scan finish. It reads the whole tree over a few connections and keeps going with fewer if the host refuses extra ones.
Choose the lens results list mode. The lens puts security items first, and world-writable files and folders are among them, alongside database dumps and backup archives in web-accessible folders. Each row explains why it is there. You can sort by the columns, which include name, size, modified and type.
Setting them right
Pick the items you want to change in the list or tree. Tagging helps you gather them as you go: you can tag rows one at a time, tag everything listed, or tag a whole folder. Then open Permissions.
Permissions takes octal modes, the same three digit numbers you see in hosting control panels, and offers presets: 600/700, 640/750 and 644/755. The first number of each pair is for files, the second for folders. 644/755 is marked as recommended and suits most websites: the owner can read and write, everyone else can only read, and folders can be opened. The tighter presets are for files that only your account should read, such as private configuration.
If your choice includes a folder, you can choose to apply the change to everything inside it too. That is handy for an upload folder full of files that inherited the same loose setting. Use it with care on large folders.
FTP by Zaweba won't make things world-writable by accident. Choosing a world-writable setting needs an explicit I understand confirmation.
What if something stops working
Occasionally a script really does need to write into a folder, such as a cache or an uploads folder, and on some hosts that needs more than 755. If a part of the site breaks after you tighten permissions, open the operations log. It lists everything Disk has done, batch by batch, and permission changes can be undone as a batch with Undo this batch. Then ask your host what the folder needs; many hosts run PHP as your own account, so 755 is enough.
Protected paths such as .htaccess, wp-config.php and .env are left alone by Disk unless a site option allows it. If your configuration file is world-writable, the lens will still tell you, and you can fix that single file in your host's file manager or by turning the option on briefly.
Making it a habit
Run the lens after any big change, such as installing a plugin or moving a site to a new host, because installers are a common source of loose permissions. Exporting the lens list to CSV before and after gives you a simple record of what you changed. A server with no world-writable items left is one less thing to worry about.
