Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My client's website was recently defaced and they are seeking was to mitigate this risk. They have a dedicated server running apache and mod_php. The website consists of three separate php applications installed in different folders (Customer portal script, wordpress and a custom database driven script). Their security audit recommended that each script be isolated so that if any of them was hacked, the other two would be safe from defacement etc. They also recommended using fast-cgi over mod_php. Suexec was also mentioned although its not clear why this was recommended.

Can someone please confirm if this makes sense and is actually possible/feasible. If so, what would be the best way to achieve the proposed security solution?

share|improve this question
up vote 1 down vote accepted

Using suPHP or suEXEC (+ fcgi/cgi) is a good decision for securing your server(separate the applications).

But to do this, you need to have different vhost for the each of those applications, let's say for ex.: ,, If your site structure is like this above, there won't be a problem to setup 3 virtual hosts, using 3 different users/groups for serving the php(with the mentioned methods - suexec,suphp).

share|improve this answer
It is not setup like this, each app is in its own folder, not subdomain. What can I do in this situation? – Michelle Oct 2 '10 at 7:17
In this case i don't know a way for isolating/separating the applications. But if it's a critical task, better try assign different domain names (subdomains). – gryzli Oct 2 '10 at 10:53

If so, what would be the best way to achieve the proposed security solution?

Best use virtual machine(KVM,OpenVZ,XEN,Jail) for each site or use chroot(mod_chroot,php-fpm).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.