Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

Are there any best practices for wordpress hardened install on Linux? I have recently had a WAMP server get malware attacked via word press so I want to harden the server up using read only apache permissions and move them and all future wordpress sites to Linux only

the plan:

  1. chown everything root:root -R so that apache can't write to anything
  2. chmod so that only owner can write
  3. chown only the uploads / updated files/ themes/ dirs of wordpress to apache: root

this last bit is the bit I need help on, can you tell me which bits of auto-updatedness wordpress is likely to need? I have looked online and no-one is talking about this.

share|improve this question
    
downgrade? are you serious? WordPress is a liability 3rd party application and you downgrade me trying to mitigate it? It's either this or I have to ban word press from my servers –  conners Aug 21 '13 at 10:55
    
This belongs on serverfault or stackoverflow. –  Wyck Aug 21 '13 at 14:15
    
It is very broad but is a "server configuration for WordPress" question. I think it is on topic. –  s_ha_dum Aug 21 '13 at 14:19
    
@Whyk why? - it's not a server installation question nor a programming question –  conners Aug 21 '13 at 14:27
add comment

2 Answers

Heavily edited from the above link

How to Harden your Word Press if you're a server admin

Bear in mind I am not an expert on Word Press nor even a user of it: you will probably not be able to automatically self update word press (which is by default a massive security issue since vulnerabilities today are published in the future by the open source community and easily viewable/used in the future) by using this method and your may or may not be able to install/update plugins and you will not be able to do this at all on Windows Servers.

/ 
The root WordPress directory: 

all files should be writeable only by your user account (*not Apache*), except .htaccess if you want WordPress to automatically generate rewrite rules for you.

/wp-admin/ 
The WordPress administration area: 

all files should be writeable only by your user account (*not Apache*).

/wp-includes/ 
The bulk of WordPress application logic: 

all files should be writeable only by your user account (*not Apache*).

/wp-content/ 
User-supplied content: 

intended to be writeable by your user account AND Apache.

Within /wp-content/ you will find:

/wp-content/themes/ 
Theme files. 

If you want to use the built-in theme editor, all files need to be writeable by the web server process (Apache). If you do not want to use the built-in theme editor, all files can be writeable only by your user account (*not Apache*).

/wp-content/plugins/ 
Plugin files: 

all files should be writeable only by your user account (*Not Apache*).

so the ACTUAL answer on CENTOS is:

do the following substituting mywordpressplace for your word press installation directory, do the commands as root and use root too if you like it won't matter, the books say you should do the following shell commands in root and then use a 3rd party user as the user in the command line entries below but I think that if you have multiple servers (I have around 40 that I run) and if you have hardened infrastructure it's probably satisfactory to merely use root for both - so long as you have ssh correctly configured etc etc

# chown -R root:root /var/www/html/mywordpressplace/
# chmod -R 744  /var/www/html/mywordpressplace/
# chown -R apache:root /var/www/html/mywordpressplace/.htaccess
# chown apache:root /var/www/html/mywordpressplace/wp-content/ 
# chown -R apache:root /var/www/html/mywordpressplace/wp-content/themes/
# chown -R apache:root /var/www/html/mywordpressplace/wp-content/plugins/

one last gotcha

the last bit is important - since the wordpress malware that can and does exist often uses php to read/write/traverse your directory to insert code and since apache must be able to read the /var/www/html/ dir you also need to ensure that anything ELSE on that server in /var/www/html/ must ALSO be

# chown -R root:root /var/www/html/*

What happens is that WordPress malware will traverse the web root dir and inject code (curl() commands usually) into any index.php/default.php files from OTHER sites that are NON word press at all. Wordpress can often be the vector for other sites on the vhost

share|improve this answer
add comment

... can you tell me which bits of auto-updatedness wordpress is likely to need?

WordPress doesn't need any "auto-updatedness". Auto-updating is just a convenience. In fact, the built-in updater is a relatively new thing, though I don't remember at what version it appeared. You can always update manually via (s)FTP and I pretty much always do.

I have looked online and no-one is talking about this

No one is talking about what?

http://codex.wordpress.org/Hardening_WordPress

share|improve this answer
    
I still say no-one is looking at this properly that was a lot of TLDR about concept based stuff and not even examples of commands for admins just a general principles guide with some dig yourself to finish –  conners Aug 21 '13 at 14:44
    
"TLDR"? "Too long didn't read"? Seriously? –  s_ha_dum Aug 21 '13 at 14:55
    
.. it is lengthy there are there 28 headings, most (almost all) are actually good policy chit-chat, or intro-ing of concepts and a general mixing from a non-wp-server-admin/non-admin-user point of view with a bias to the latter (EG: config specifics, rewrite rules etc, asusing .htaccess only) –  conners Aug 21 '13 at 15:06
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.