I've got a question regarding Nginx and www-data user on my VPS.

Lets say i got two sites siteA and siteB under a common parent folder /var/www. Both sites and the parent folder have www-data as the user and group. If siteA get compromised/hacked would the hacker be able to access the files on siteB?

I've read on another post that to prevent this I should run each site under its own user and group. How would i go about achieving this with Nginx?

siteA is a WordPress site using php-fpm and siteB will be a NodeJS app

  • What is the upstream server? php-fpm, uwsgi?
    – mzhaase
    May 2, 2017 at 14:24
  • @mzhaase siteA is a WordPress site so php-fpm and siteB will be a NodeJS app
    – Dani
    May 2, 2017 at 14:27
  • 1
    I don't have enough time for a proper answer, but the things you need to secure and implement multi-tenancy at are php-fpm and nodejs. For php you can have a different pool and user for each site, I don't know how it works for node.
    – mzhaase
    May 3, 2017 at 8:57

1 Answer 1


It's worth noting up front that the type of attack you're asking about (website defacement) is a relatively infrequent form of attack. Hackers are usually more interested in stealing data and/or hijacking your entire server. It's also relatively easy to counter defacement by simply replacing the website content. Unless you have a determined enemy, that will often hold you over while you track down the vulnerability that led to it.

That said, yes the configuration you describe introduces a larger attack surface than having separate sites, and yes there are things you can do to reduce that surface.

First thing you can do is use standard linux groups and users to completely deny write access to all static website content and source code. You can do that by creating a www-admin user and chown all content to that user. Then have a different user (or users) for the programs and services. A common web-service user is the user nobody, but special-purpose users such as www or http can also work. Put static content and source code in their own directories, owned by www-admin, with permission 755 on directories and 644 on files. That will prevent any changes to your site by a compromised web service or application. You can fine-tune this further with groups if you want for convenience reasons, but for security this ownership set-up will protect your files from web-based defacement and is easy to implement and maintain.

By default, nginx does not accept http TRACE, DELETE, or PUT requests. However, it's a good idea to test this:

curl -v -X TRACE "http://www.example.com"
curl -v -X DELETE "http://www.example.com/dummy-page.html"
echo evil > ./test4evil.txt
curl -v -X PUT "http://www.example.com" -F "file=./test4evil.txt"

You should get 405 (not allowed) responses for these tests.

If you would like site visitors to be able to upload content, create special user-content-only directories for that and narrowly assign write permissions to those directories to the app/s or service/s that do the uploading. By narrowly, I mean avoid giving write permission to users or groups that don't need to write to that directory.

All of this addresses files on disk only. Since your sites generate content dynamically, you should also make sure you address php injection, sql injection, and other potential exploits related to dynamic content. However, that's a different topic and the question here is only about preventing changes to files on disk.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .