Thread Starter
Famous
(@famous)
Who owns the files and directories?
myuser:apache
Or
apache:myuser
Or
myuser:myuser
apache:myuser
but that’s not horribly secure.
If you’re up for it, see https://wp-root.org/server/install-php-fpm-tcp-unix-sockets-centos/
Thread Starter
Famous
(@famous)
So that’s the concern — is what are most people doing :/
If that’s not secure, then why doesn’t WordPress provide specifics like Magento so that we can lock the site down a bit better? I understand that a majority of installs are done through cPanels & goDaddy type installs, but what about dedicated servers & cloud environments. It would be nice to get specifics on those.
Not sure on phpFPM :/ kinda too much, but thats the only solution then I guess
The idea is that you run each website on your server as a different user so if I hack site1 in /var/www/site1 and gain control of the PHP process, I have no permissions for /var/www/site2, etc. It limits the damage.
WordPress is open source software. It’s up to you to understand how to sysamdin if you choose to run your own server. Those who don’t or don’t want to are better off with shared hosting or a managed WP provider.
Thread Starter
Famous
(@famous)
Ok so it looks like:
apache:myuser
and
directories 775 or 770, files 664 or 660
is the solution.
Thanks
