diff --git a/.gitmodules b/.gitmodules
index 3f301043afe61a2207c0aab91b1b2c03a0a475e2..5c7397b16d48523707032b909713455121faae5f 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -55,3 +55,6 @@
 [submodule "modules/network"]
 	path = modules/network
 	url = https://github.com/example42/puppet-network.git
+[submodule "modules/chmod_r"]
+	path = modules/chmod_r
+	url = https://github.com/declarativesystems/chmod_r
diff --git a/modules/chmod_r b/modules/chmod_r
new file mode 160000
index 0000000000000000000000000000000000000000..8e459b8dcf93d046c1a8a2810cac6f34e10cff6e
--- /dev/null
+++ b/modules/chmod_r
@@ -0,0 +1 @@
+Subproject commit 8e459b8dcf93d046c1a8a2810cac6f34e10cff6e
diff --git a/modules/wordpress/manifests/init.pp b/modules/wordpress/manifests/init.pp
index 35260e55caa806e7e37995bee80e3be5c222c506..f06f5f7d248a8b0bdec46f2847345ccbd7ccf928 100644
--- a/modules/wordpress/manifests/init.pp
+++ b/modules/wordpress/manifests/init.pp
@@ -31,7 +31,6 @@ define wordpress (
     ensure  => directory,
     source  => "${wp_root}/wordpress",
     recurse => remote,
-    # TODO ensure that all files keep belonging to www-data
     owner   => 'www-data',
     group   => 'www-data',
   }
@@ -48,6 +47,10 @@ define wordpress (
     }),
   }
 
+  chmod_r { $wp_path:
+    want_mode => '0664',
+  }
+
   file { "/var/wordpress_dump/${url}":
     ensure => directory,
   }