0

Most shared hosting packages store all files of a given user under something like /user/myuser/www/ or /var/html.

Addon domains are usually located under /var/html/domain1.com/, /var/html/domain2.com.

Is there a way to (using .htaccess) prevent one addon domain from accessing the files of another domain and a potential malicious script (e.g. a rogue theme) from reading or executing or writing files to another addon domain's folder?

This way, if one site is compromised, the others will not be affected.

I realize this is not the only required step to harden the security of a WordPress installation but it's a good starting point to prevent a potential exploit from doing too much damage.

Improve this question
3
  • I think you should setup domains outside www. For example. /user/myuser/domains/domain1.com and /user/myuser/domains/domain2.com. This will make one domain files inaccessible from other domains.
    – Robert hue
    Commented Jun 18, 2015 at 13:11
  • How so? If a malicious PHP file inside a theme allows POST uploads and allows a hacker to upload one of the common shell exploits, he can use that shell script to read and write files inside any directory on the server. Is this true? What I asked was - even if this shell script is planted, how to prevent it from writing/editing files outside its corresponding WordPress installation.
    – Dzhuneyt
    Commented Jun 18, 2015 at 15:32
  • Uploading shell exploit and then having shell access will make all websites vulnerable. In that case, you can't do anything to protect other websites, specially on shared hosting.
    – Robert hue
    Commented Jun 18, 2015 at 16:28

2 Answers 2

Reset to default
0

It would be better to use file permissions. However, this doesn't work with all hosters.

Go to your FTP explorer and change the file permissions of an image to 400 (only read for my own user, all others have no right at all). Can you still access this file via the web or do you see a 403 Forbidden error? If it works you can do this for all files and add write permissions where you need them. Then try out if the upload still works.

If the other sites have different file users, then this will prevent them from accessing your files. This normally requires CGI/FCGI or similar setups.

Improve this answer
0

You can also try to use the php.ini-Option open_basedir but this only works if all websites are using it.

Here is my complete .user.ini (you can put them into the htaccess if you want):

register_globals=false
magic_quotes_gpc = Off

session.use_only_cookies = 1
session.cookie_httponly = 1

disable_functions = "exec,system,passthru,shell_exec,show_source,popen,escapeshellcmd,proc_open,proc_nice,ini_restore"
allow_url_fopen=0
safe_mode=0
open_basedir=/var/www/vhosts/website:/tmp

error_reporting=E_ALL
display_errors=0
log_errors=1
error_log=/var/www/vhosts/website/logs/php_error.log

default_charset="utf-8"
mbstring.internal_encoding = "utf-8"
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.