Got Wordpress working but getting error trying to install themes

The error message kind of points you in the right direction - did you check the permissions on that directory? It needs to be writable by _www (the user that your web server runs at).

FWIW this is a oommon problem. WordPress is a nightmare to get running, especially if you care at all about site security.

Do I need to change both the user and the group to _www ?

That depends on the privileges on the directory. Generally I'd set just the username.

Why don't the website folders that I create through the "server" application have the correct permission settings by default?

Define 'correct' please. Before you answer, bear in mind that the Server apps have no idea that you're running WordPress, just that you're creating a web site.

Also bear in mind, that as far as best practices are concerned, the 'correct' permissions for any directory accessible to the web server is read-only. There's generally no need for Apache to write to the filesystem, and allowing it to do so opens the door for hackers who might compromise your web server.

Given that, I'd say that the defaults (no write permission) are the correct permissions and that it's your use case (i.e. WordPress) that's making you jump through hoops.

Maybe a little late, but to I had the same problem, to add to Camelot's answer, highlight your theme's folder, press command + I to get the info window and set the permissions to 777, that did it for me. By default WP permissions are set to 644 or something similar.

M

WordPress has no idea about web security. I'm appalled at how bad WordPress expects - no, requires - the file permissions to be. I'm surprised WordPress doesn't get exploited even more than it already does.

You should be grateful that Apple doesn't setup the web server to follow WordPress' 'security' model.

If you don't understand the basics of web server security then you are hanging your proverbial *** out in the wind asking some hacker to come along and take over your site for his wares.

press command + I to get the info window and set the permissions to 777, that did it for me

This is just about as bad a set of permissions as you could have - unless you're a hacker, of course, in which case this is a dream come true.

Under ideal circumstances, the web server should be able to read but not write to the web content directory. You've just said everyone (and his dog) can both write to and execute any file in your web directory. That's asking for trouble. What's worse is that WordPress pretty much demands this, which means you really need to go out of your way to setup a secure WordPress installation.

Well answered Camelot, on the security issue of course you're right, what I forgot to mention is to set the permission back to default when done with the templates and themes. Can you explain how is this a security issue when is only the theme's folder and setting those permissions back to default? The root of WP, includes, admin, contents folders stayed default. I'm not an expert, but is there something I'm missing here?

Trying to learn a little more Camelot.

After reading your post for a second time, I see exactly your message. WordPress doesn't require change of permissions, themes and templates are custom additions to it, Permission changes is not to the content folder, but the themes's folder inside the content folder until you're done customizing, then back to default, and only in some instances.

He mentioned he had MySQL working on OS X Lion Server as a database, there is a reason why Lion Server uses PostgresSQL as database now instead of MySQL, PostgresSQL is more robust and of course more secure, it was also changed because Oracle bought MySQL (from what I heard). Found that out when setting up my WP blog at home, but decide to stick with MySQL and hosted somewhere else until WP implements or allow for PostgresSQL, it can be done but it needs a lot of heavy php code writing, not my fortè. You got me thinking on a couple of things, thanks Camelot, good points.

Having Wordpress working and secure is possible.

There are different folders inside Wordpress directory that divide the "need to write" from the "need not to be writteable".

Mostly, the wp-content/ directory is the only one which needs write permissions.

There, Wordpress will store the uploaded images, themes, and plugins.

you'll see:

wp-content/plugins

wp-content/themes

wp-content/upload

In fact, in production sites where you are not going to mess up with themes and plugins, only the "upload images" folder need to have write permissions, which is normal and common need in all "social like" web sites.

That's another way of explaining my point tArre, in his case it was only the upload folder.