Hacker News Reader

Comment by mschuster91 | Hacker News Reader

...so one of the basic security things one must do on a webserver is separating the vhost unix accounts (to avoid compromised installs overtaking other vhosts), as well as separating the web server virtual account from the FTP account.

Wordpress then can update itself using your FTP credentials, but a malicious or hacked plugin can not compromise the site.

View on HN

That still leaves the wp-content directory and everything in it, including other plugins, writable by the web server. A malicious or compromised plugin can then check whether some of the highly popular plugins are installed, and modify their files to compromise the whole site. You don't need access to WordPress's core files to inflict a huge amount of damage.

Some directories do need to be writable for caching and uploading purposes, but those are just data, and data is usually inert. It's dangerous to leave any executable file (*.php) writable by the web server.

>That still leaves the wp-content directory and everything in it, including other plugins, writable by the web server.

You don't have to have the wp-content directory writable by the web server. I certainly don't on the WordPress installs that I maintain. I also do not have FTP open and listening. Users can SSH/SFTP files up if they wish, but I don't let the web server write into the Wordpress area for specifically that reason.

It does not, read exactly what I've written above - there are three users in total: your ssh login-account, the (user-unique) PHP account (suphp or similar solution used for this) and the user-unique FTP account.

So, if you set up the ACLs and permission bits correctly, the webserver has no write rights, only you and the FTP user have.

Reply on news.ycombinator.com