I have a basic LAMP installed and I'd like to secure it that the PHP won't be able to access anything outside the /var/www directory. How can I do that? By "access" I mean also reading files and directory listing.

I am asking for this because of security. I'm running WordPress on my server and if someone gets to the administrator account, he can edit template code through which he can get anywhere in the system.

Thank you!

  • 1
    If you can edit php code through wordpress you definitely have your wordpress misconfigured and should fix that asap. Because if this is the case, YOUR filesystem is the least of your problems. Templates should only use HTML, JavaScript and CSS, nothing else
    – Broco
    Commented Jan 15, 2017 at 22:26
  • Use an SELinux enabled distro (e.g. RHEL/CentOS, Fedora) and you get this for free. Commented Jan 15, 2017 at 22:32
  • @Broco As far as I know, this is a defaultly enabled feature of basic Wordpress installation, where you can edit the templates' and plugins' source code. And templates/themes in Wordpress need, of course, PHP so the can show posts etc. Commented Jan 16, 2017 at 6:06
  • 1
    No, it's not. Per default you can only use placeholders in WordPress, not actual php. You basically define areas where predefined functions are included (e.g. comment section) but you cannot write executable php code in WordPress admin panel. If you can, it's not default, and not safe.
    – Broco
    Commented Jan 17, 2017 at 6:31
  • @Broco I can see it now. My file permissions were wrong. Thank you. Commented Jan 17, 2017 at 11:37

1 Answer 1


Here are the key steps to secure a LAMP setup:

  • Ensure all websites run with their own user. You can achieve this with Apache mod_itk/mod_php or PHP-FPM (Usually with Apache or Nginx)
  • Ensure root owns the files and group is web server user (or vice versa)
  • Ensure access rights are 640 for files, 750 for directories. Only Wordpress upload folders are 660/ 770.
  • Only when you upgrade or install plugins, change access rights of PHP files.
  • Ensure PHP files cannot be executed in images folder:

    <FilesMatch "/uploads/\.(asp|php|php5|pl)$">
        Deny from all

    This technique doesn't work too well with Wordpress because plugins install php files into that folder. You may be better off to secure the uploads/2017 etc folders

  • Keep installation up to date
  • Keep server software up to date
  • Run a regular log review
  • Have backups
  • Be able to rebuild fast

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .