0

I want to build my sites with Wordpress files that can't be modified and dirs where new files can't be added. Static content with permission without possibilities to execute, that will served by another web server (can't execute php code).

Updates will be provide by change wordpress root, and update database.

I want to know what security brakes will stay? I am not talking about if there are linux kernel exploit, apache exploit. my question is only about Wordpress. What security brakes that attackers can use in Wordpress, where files and dirs are unmodified and all permissions (include database) are right?

For easy: Admin password was sniffed/whatever. And Attacker has it.

PS: Sorry for my English

Regards.

Improve this question

1 Answer 1

Reset to default
1

If you can't modify anything on the server (site fully static) then there is no point in trying to break into it.

In enterprise kind of setting you can achieve this by limiting login and restricting write permission to only people coming from the local network, but for most people this kind of setting is too hard to configure and maintain, and doesn't fit their work flow (for example you can't post new content from anywhere in the world but only from specific location or only if using specific software).

Edit

Should have been more explicit about it, the answer is that security is a process and not application of specific tool or method. The only way to make sure that your site is secure to check that all of its components are secure and then check that they are connected with each other in a secure way.

Improve this answer
10
  • I mean not static site. But Wordpress files that can't be changed. For example wp-config.php attacker can read, but can't modify. index.php is executable but not modifiable
    – Valeriy Solovyov
    Commented Feb 25, 2015 at 13:07
  • just because a site is running on php doesn't make it dynamic. a dynamic site interacts with the users that surf it in a way that a user can make a change in the site, for example by sending a comment (even if not published it did change the DB). The easier it is for a user to interact with the site the harder it is to secure it with "buzzwords" and you have to audit each line of code to ensure security. Even simple things like search forms and pages that show search results have been used to break into sites.
    – Mark Kaplun
    Commented Feb 25, 2015 at 13:22
  • When wordpress is working, his file don't changes(mustn't, only on updates). All changes inside database (I don't forbid update database).
    – Valeriy Solovyov
    Commented Feb 25, 2015 at 13:29
  • with only access to the DB, the attacker can create for himself a new admin user and upload a new theme. Or he can put spam links in all post.
    – Mark Kaplun
    Commented Feb 25, 2015 at 13:35
  • but if dirs and files permissions don't allow to update any php code?
    – Valeriy Solovyov
    Commented Feb 25, 2015 at 13:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.