When it comes to improving the security of a WordPress website, installing security plugins is usually considered as the best practice that every WordPress website must follow. However, people don’t pay much attention to setting up file permissions and ownership of a WordPress site. But remember that, file permissions and ownership are crucial elements that help ensure the overall security of a website. And, not setting up them properly can cause fatal errors and can compromise the security of your site and make it susceptible to attack.

Through this post, I’ll provide a detailed insight on setting up proper file permissions and ownerships in a WordPress site: what exactly do we mean by file permissions and ownerships and how to properly set them up. I’ll also share with you the different type of WordPress file configurations and how they differ from each other.

Using Terminal For Changing Permissions and Ownerships Over FTP Client
As you read through this post, in several sections, you’ll find that terminal is used for changing permissions and ownerships. But, probably a few of you might wonder why can’t you use an FTP Client to serve such a need? The reason that we’ll not be using the FTP client is that it comes with certain limitations.

Wondering what?

While it’s true that the FTP Client can help in transferring files and changing the permissions of files and folders, but it refrains users from changing the ownerships settings. Now, before you begin to setup your file permissions and ownerships, be sure about getting logged-in into your server using the “SSH” command. If you’re not familiar with using Linux commands, then you can have a better understanding of the same by going the article: “Introduction to Linux Commands.”

Understanding the Difference Between Groups and Users
One important concept that you need to become familiar with before getting down to anything technical is the difference between users or groups. That’s because, both users and groups are closely related and are used to define permissions.

The user is basically an account having access to a computer system, while a group that help identify a set of users. What this means is that at the time whenever you need to transfer your files using an FTP client, you’ll need to get logged in with your main server – using your user account. And based on how your web host has set up your user account, you might be a part of one or more groups.

In essence, you can consider “Users” and “Groups” to be just like WordPress users roles. Both of these concepts are same in a contextual manner, however, the former is being used on the server.

What makes users and groups important is that they help in recognizing identifying files and folder privileges. Any user, who is the owner, of a particular file usually have complete privileges on that file; a few other users belonging to the same group as the owner will have lesser privileges to the file. Lastly, everyone else won’t be having any privileges on the file.

What Exactly Does File Permissions Mean?
So now that you’ve come to know about a few basic aspects of file permissions and ownerships, let us now talk about what exactly do we mean by WordPress file permissions.

In simple terms, permission is something that makes users authorized to read, write, modify and access different files and directories, belonging to a website. In WordPress, permission is normally highlighted by a set of different numbers, such as: 644 or 777. These numbers are also referred to as “permission mode”.
If you’re a programmer and have worked on WordPress files and plugins before, then you most likely would have stumbled across a situation wherein: a certain program asks to change the permissions associated with some specific files and directory, since they cannot be configured by a plugin. Put it simply, in order to give your web server the ability to access anything from a file, you’re required to change the file’s permission.

Oftentimes, permission mode in WordPress are being referred to as a statement: “who can do what”, to which every single numeric value (of the permission mode) represents the “who” part of that statement.

• The first numeric value corresponds to what can a user account having ownership of the file can do.
• The second numeric
  value corresponds to what all other user accounts – that are a part of the group that owns the file – can do.
• The third numeric value represents
  what leftover user accounts can do.

Next, in the permission mode the numbers represent
the “what” part of the programming statement, and is basically the “sum of the combinations” of the following digits:

• 4: Read a file, or the many different names of the files placed in a particular folder
• 2: Write a file or modify it, or allow modifying the contents of a specific folder.
• 1: Executes a file or run it, or help provide access to the files inside a particular folder.

 
The above mentioned digits are actually the privileges that are associated with the “who” part of the permission mode.
Note: Permissions can vary from one host to the other.

Understanding How You Should Modify the Permission Modes
An FTP client provides an interface that allows to change the permissions of all the files and folders in a highly convenient manner. The interface of the FTP client looks something like:

You can even make changes to the permission mode of your WordPress website files using the server’s terminal, but you must-have access to the terminal. Apart from having access to the terminal, you can make use of the “chmod” command for making the desired changes to permission modes of a particular file as well:

sudo chmod 644

Now, for making modification to all of the files (and folders) of your site, you’ll have to use the chmod command together with the find command, as follows:

sudo find . -type f -exec chmod 644 {} +

A Look at the WordPress Server Configurations
Before you start to make changes to your WordPress file permissions, it’s very important for you to become familiar with the process of setting up the server first. You can find many different server configurations that requires a distinct set of permission modes to make a WordPress site work in a proper and secure manner. But, I’ll be sharing only two of the most important and commonly used configurations and how you can set up proper file permissions for those configurations.

1. Standard Server Configuration – This WordPress configuration does not have any relationship between the user account and web server. This is because the configuration requires that the web server must run as any other user account. Before we start with the process of setting up permissions for the files for the standard server configuration, we must make some adjustments to the ownerships of files and folders taking into account the following considerations:

• your user account must own all the files and folders of a WordPress install.
• your user account and another user account of your web server should be part of the same group.

You can find out the group that your user accounts are associated with, using the “groups” command within your server’s terminal. And, to figure out the groups that your web server is a part of use the following PHP script:

echo exec( ‘groups’ );

If you come across a situation where your user and the web server belongs to a different group, then you can add a user to any group of your web server, by using the below provided command in the terminal:

sudo usermod -a -G <a-the-group-name> mygroup

In order to ensure that your user account has access to all the things of your WordPress folder and belongs to the newly created shared group, simply run the below mentioned command within the folder of your WordPress install:

sudo find . -exec chown mygroup:a-the-group-name {} +

Abiding by all of the aforementioned commands will ensure that all the files and folders of your WordPress site have correct ownership. Lastly, all you have to do is to make adjustments to the file and folder permission mode. To do so, you must keep the following key points in mind:

• All files are required to have 664 permission mode.
• All folders are required to have 775 permission mode.
• The permission mode of the wp-config.php file ought to be 660.

 
Use either an FTP client for modifying the permission modes, or simply use the below mentioned commands within your WordPress install directory to serve such needs:

sudo find . -type f -exec chmod 664 {} +
sudo find . -type d -exec chmod 775 {} +
sudo chmod 660 wp-config.php

2. Shared Server (Or SuEXEC) Configuration: Compared to the standard WordPress server configuration, the permissions for the shared server configuration can be implemented in a remarkably easier way. This is because, we don’t need to emphasize on setting up the ownership since the web server owns the files and folders. This means that both our user account and web server are the owners, and have same privileges. And so, all we have to do is to modify the permission modes considering the below listed key points:

• all the files ought to be 644.
• all your folders ought to be 755.
• And the permission mode of wp-config.php file should be 600.

 
To change the permissions of the files and folders, simply use the following commands in your WordPress website directory:
sudo find . -type f -exec chmod 644 {} +
sudo find . -type d -exec chmod 755 {} +
sudo chmod 600 wp-config.php

Final Words
One more important thing that you must consider is to avoid using the ‘777’ permission mode since it allows anyone to get access to the list of files, and enables to make modifications to any file in the folder. It’s pretty obvious that giving access privileges of a file to everyone is not good for your website security, as malicious users can place code in the file that can compromise your site’s security.

Hope that the post will make you better understand about the correct way to set up the file permissions and ownerships of your WordPress website.

Author Biography:
Jack Calder is a master in Web development technologies. He has successfully completed so many projects on time. Right now he is a PSD to WordPress Conversion service provider for some potential clients for SKT Themes.

With the rise of modern information technology and the proliferation of cybersecurity breaches happening, being able to detect attacks in your network has become quite the necessity. Cybercriminals certainly aren’t slacking. Every day, they come up with all manner of new strategies that they can use to infiltrate a vulnerable network. In such an environment, your top priority should be to take preventative measures rather than reactive ones. You should be able to sniff out an attack long before it happens.

However, that’s easier said than done because, as it turns out, one of the most difficult and expensive endeavors to embark on is monitoring your system’s activity to prevent network attacks. It doesn’t have to be that way, however. You need to have a good idea of the best ways to handle it.

Ultimately, the main thing that matters to stopping network attacks before they get out of hand is transparency. You need to increase visibility in your network so that you can see more of and consequently stop more often. That’s what we’re going to be looking at today: tips on how to increase visibility in your network with Syslog.

1. Always Be Vigilant :

At its very core, Syslog is no more than a standard whose job is to log system messages. It is much more useful than that in practice, however, as it gives us a way to abstract the system messages in such a way that we can separate the systems that store and analyze source software from the source software itself. This makes it possible for us to be very flexible and control the kind of low-level detailed communication that takes place in our networks.

One of the reasons why it makes sense to get syslog services from a cloud provider, rather than do it yourself, is that you can be overwhelmed by the sheer volume of messages coming from the different devices on a network when you’re monitoring your infrastructure. You’ve got network appliances, storage appliances, servers, desktops, printers and so on. All these devices are pumping out logs, most of them rather cryptic and you’re probably wondering where you should start.

The answer to that question becomes simple once you remember the whole purpose of syslog in the first place, which is to increase visibility. If you want to maximize the visibility you are getting out of your logging environment, then you should have at least one centralized log repository and deploy it. This is what infrastructure monitoring services do. The log repositories act as dynamic organizers and managers of the messages flowing out of your system. With this highly organized aggregation and analysis of your system logs, you will be able to solve your problems in real time, but you will also be able to collect vital information that will help you to prevent future attacks.

We can’t get into the specifics associated with setting up a remote logging server, but that doesn’t mean the process isn’t straightforward. You need to find the -/etc/syslog.conf- file on your most critical devices once you initialize the server and then get the file to point to the repository you have just created. That way all messages are funneled through to that repository. All these messages come in as plain text files, so it’s a good idea if you tunnel them through SSH port 514.

2. Catching the Threats :

So, you have a central place where you are collecting system messages. You should now have a way to analyze these messages that is automated. The messages are usually tagged with the facility and severity, which means it’s very easy to sort them. This is where a third-party logging system helps since it can filter out logs from various devices, such as network appliances, for such things as internet protocols (IPs) you do not recognize, dropped packets, port scanners and lots of other things that hint at malicious behavior.

Now all you need to do is configure any messages that report suspicious IPs or dropped packet floods to trigger notifications automatically and the resolutions that follow. A third party log analyzer will have these triggers already integrated and probably connected to your email or text messaging. The resolution measures, such as port switching, IP blocking and alterations to the firewall can also be set up to respond in a times manner to deal with attacks.

Try to configure each solution effectively. You should figure out the usefulness of the information you are getting from each device that you make a priority. The highest priority devices should be the most visible.

Ultimately, most of the information you need to protect your network is already being generated by your network. All you need to do is organize it and make it visible.

As a webmaster, you want the world to have access to your website. That’s especially true if you have a product or service to sell.

However, there are reasons why you may want to restrict access to your website. If you happen to operate a landscaping company in British Columbia, Canada, then you’re probably not interested in generating interest from potential customers in the Philippines. Broadcasting your website to the world and allowing other countries to index it is a waste of bandwidth.

Allowing worldwide access to your website is a bad idea for other reasons. As Privacy Australia notes, many hacking and phishing schemes are conducted by bad actors in other countries.

Which Countries Have the Most Hackers?

According to Security Today, the countries that have the most hackers are China, Turkey, Russia, Brazil and the U.S. Depending upon where your company is located, you may want to block access from any or all of these countries.

If you have customers in these nations, then blocking access won’t work. Instead, you’ll have to beef up website security. Some of these steps may include:

-Keeping your software up to date

-Installing any pertinent security plug-ins

-Employing HTTPS

-Making all passwords complex

-Using Content Security Policy

-Securing File Permissions and Directories

Whether you’ll be blocking access from certain countries or not, the above list of security protocols is critical to protecting your website.

What Is .htaccess?

Suppose that you have identified users from a country that you suspect are trying to hack or otherwise undermine your website. You’re located in Canada, and the website visitors have IP addresses that originate in Turkey. Your business does not operate in Turkey, you have no customers there and you’re worried that you’re being targeted for an attack.

What can you do?

The answer may lie in .htaccess. This configuration file is used on web servers that run Apache Web Server software. The .htaccess file is loaded onto the server software where it is subsequently executed. These files can be used to disable or enable numerous functions and features.

Among the capabilities of .htaccess is blocking website visitors from unwanted IP addresses. Here is an example of the code you would create to restrict visitors from certain IP addresses from being able to access your website:

order allow,deny

deny from 255.0.0.0

deny from 124.35.6

allow from all

Accordingly, all visitors with either the IP address 255.0.0.0 or 124.35.6 will be denied access. Notice that in the second denied IP address, the fourth set of numerals is missing. All IP addresses that begin with “124.35.6” will be blocked regardless of the content of the fourth set of digits.

The next time that someone from a blocked IP address tries to access your website, they will receive an error message that says “403 Forbidden.”

What If You Have a Long List of IP Addresses to Block?

Any hacker worth their salt isn’t going to use just one IP address. They may use several, and many hackers now work out of farms. A webmaster can block one IP address, but the same bad actor just pops up a few minutes later with a new IP address.

Adding each IP address to the “deny” list in your coding is time-consuming and likely to be a losing battle. Fortunately, you may be able to make use of some alternatives.

Some webmasters who are really concerned about being targeted by hackers in another country are getting memberships for service providers such as Country IP Blocks. This Internet-based service allows users to choose specific countries that they would like to block from accessing their website. It’s possible to select multiple countries at a time and what kind of restriction protocol, including .htaccess, should be used.

After making selections, the website generates code that can be copied into the user’s website to prevent web browsers from certain countries from accessing the website. Comprehensive in scope, this is an efficient shortcut when compared to having to painstakingly enter IP addresses one by one.

Options for People Who Don’t Want to Use .htaccess

.htaccess configuration files are fairly helpful when it comes to limiting access to a website. However, it’s not necessarily the most effective or efficient method.

IP2Location may be a reasonable alternative. This company sells IP geolocation databases as well as offering a free and extensive database firewall list. Organized by country, it’s possible to choose to allow everyone in the IP address list to access your website or to ban them. If you sign up for a free account, you can block as many as 30 countries. Choose the selection Apache .htaccess deny from the menu, which gives you an appropriate text file to upload the directory on your homepage.

BlockACountry.com is another website that may be useful if you have several websites to protect. After signing up for a free membership, you enter a website address and select which countries you would like to block. This enables you to download the appropriate block list.

Your Web Host May Be Able to Help

The better your web host, the more secure your website is going to be. If you’re using shared hosting, then there may be little that your host can do to block IP address from particular countries. Although you may have access to a control panel, you may not have networking controls because any changes you made might affect all of the other websites that are hosted on the same server.

Still, you may be able to add certain IPs to your firewall. This also is the case with bare metal servers. You have complete control over this server, but you may not have control over how the back end is routed.

When it comes to blocking certain countries from accessing your website, you have many options. One or a combination of these options may help to protect your website from a hacker.

WordPress has been often under fire for being insecure. And it is good to see that team at WordPress has taken this up seriously.

WordPress releases version 3.5.2 they focused on many security fixes and exploits.

In recent WordPress release they went up ahead and fixed even more.

As suggested by Andrew Nacin on WordPress releases 3.6.1 version .

Although in this WordPress release all the CSRF vulnerabilities weren’t fixed however they fixed the file upload CSRF vulnerability.

On another note all the themes on SKT can automatically be upgraded to version 3.6.1 as they have been found to be fully compatible with.

All the custom codes inside your WordPress themes and plugins shouldn’t get affected by this update since it only holds certain fixes for security.

It is however suggested only for people who run WordPress 3.5 and above to update to latest version. Previous version WordPress users should always first back up their WordPress before upgrading and should rather upgrade to 3.5 first and then upgrade to latest version.

Regards,
SKT Themes Team