Rick Whitworth's Blog

Since I have been running WordPress on IIS 7, I have been unable to use the WordPress integrated Plugin update features. When I am in plugin manager, and click on the link that says Upgrade Automatically, I get the following error:

Upgrade Plugin
Downloading update from http://downloads.wordpress.org/plugin/download-monitor.2.2.3.zip
Unpacking the update
Removing the old version of the plugin
Could not remove the old plugin
Plugin upgrade Failed

With some help from Patrick Burch, I found out this can be fixed by providing Physical Path Credentials in IIS. In previous versions of IIS, you could only use this feature when using UNC paths. It mainly existed as a way to connect to a virtual directory on a remote machine using a fixed set of credentials. In IIS 7, this feature was expanded so that it could also be used with local directories. I have searched for a good security guide on IIS 7 with WordPress, but most of what I have seen is geared towards WordPress on Apache. So, I have played around with a couple of settings to try to enable one click plugin upgrades while at the same time keeping a secure configuration. 

DISCLAIMER: I have to admit that I have not read the security guide for WordPress, and I am only mildly familiar with the new security settings in IIS 7. So there is a possibility that what I have done to fix this problem may open some kind of security hole. You must make your own determination when changing security settings on your servers. I am only reporting what worked for me to fix a specific issue. I will not be held responsible for security changes you make to your own systems.

1. Make sure your Application Pool identity is a user account (not Network Service)
2. In IIS Manager, right-click on your website –> Manage Web –> Advanced Settings
3. Click the … button in the Physical Path Credentials box.
4. Specify the account you are using for the Application Pool Identity
5. Find the wp-content folder under your web site, right click and choose Edit Permissions…
6. Go to the Security Tab, then click Add and enter the Application Pool Identity account. Give the account modify rights
7. Click OK until you have closed out of the security dialog
8. Reset IIS
9. Test plugin update

We could have given rights to just the plugins directory, but you will still need the ability to do uploads as well, so I just went with wp-content

Please feel free to comment if you are an expert on this subject and see problems with this post.

Random Posts