{"id":290,"date":"2016-12-21T10:58:15","date_gmt":"2016-12-21T10:58:15","guid":{"rendered":"https:\/\/puvox.software\/?p=290"},"modified":"2021-11-14T13:45:49","modified_gmt":"2021-11-14T13:45:49","slug":"restrict-php-access-upper-directory","status":"publish","type":"post","link":"https:\/\/puvox.software\/blog\/restrict-php-access-upper-directory\/","title":{"rendered":"Restrict PHP upper directory access – PROTECTION FROM HACK !"},"content":{"rendered":"

\"php<\/p>\n

Security problems with cPanel !<\/span><\/h1>\n

Pre-amble<\/strong><\/p>\n

I think it is the HIGHEST-LEVEL security matter for EVERYONE, WHO HAVE A WEBSITE.\u00a0Probably everyone knows – when you host multiple domains in cPanel<\/a>, then they are listed in same FTP (even though in different folders). Unfortunately, that is default functionality of cPanel’s end-user dashboard, and probably you might have\u00a0never imagined how important security problem<\/strong> that lies behind it. You might thought one – “who needs to hack my site?” and then forget to care about security of your site…<\/p>\n

Well, that is the HUGE mistake<\/strong>!<\/p>\n

Hackers (with internet BOTS) not always\u00a0 hack your site to steal your money directly, but they do a lot of other things – stealing your information, identification info, users’ passwords and email addresses, visitors information, marketing info, links, website authority and much more. And thus, they get a big profit from any typical hacked site ..<\/p>\n

Can cPanel Restrict access from FTP\/Domain folder?<\/h2>\n

So, when you added separate domains in the same FTP, you were thinking that they were “separated” – Actually, that is not true<\/strong>. Although FTP users could be separated and restricted to specific directory, that restriction doesn’t relate to core PHP! Any of PHP file (wherever it is) CAN ACCESS ANY UPPER DIRECTORY<\/strong> !\u00a0 (DONT TRUST HOSTING’S SUPPORT GUY, WHO IS TELLING YOU THAT DOMAINS ARE SEPARATED! They dont know what they say – Try this simple php filemanager<\/a> from any of our sub-sites and you will see, PHP can access any folder in your account ! )<\/span>
\nSo, if one of your domains gets hacked, then the hacker(or bot) can access\u00a0 whole FTP and all your hosted domains and databases easily. And – we see hundreds of hacked WordPress websites every-day, that’s because people don’t take care of their website security.<\/p>\n

Well, when you are going to host multiple domains, and secure them, then the only solution is to get a different USERNAME ROOT for each domain i.e. :<\/p>\n

\/home\/username1<\/strong>\/public_html\/\r\n\/home\/username2<\/strong>\/public_html\/\r\netc...<\/pre>\n
However, that is not possible with regular cPanel accounts (a.k.a. “shared hosting”), because all “add-on” domains are put under the same username account directory, like:<\/p>\n
\/home\/username\/domain1.com\/\r\n\/home\/username\/domain2.com\/\r\netc..<\/pre>\n
(That means, all files in a CPANEL account are owned by the same user. So, same user’s PHP can access everything from everywhere. Some people said, PHP restrictions could be achieved by using open_basedir<\/code><\/strong> and safemode<\/code><\/strong>[disables EXEC(),shell_exec,system(),passthru,readfile,escapeshellarg,escapeshellcmd,proc_close. and etc..] options (from php.ini), and AllowOveride<\/strong><\/code> option (globally from httpd.conf. NOTE:this file is not available for most shared hostings), but even these options doesnt help, because cgi-bin scripts<\/code><\/strong> and cronjobs<\/code><\/strong> remains still unprotected..)<\/em><\/span><\/p>\n
However, that could be annoying for many people.\u00a0BUT, I HAVE FOUND ANOTHER SOLUTION.<\/strong><\/span><\/p>\n
 <\/p>\n
Solution to Protect any domain\/website\/FTP<\/h2>\n
\"\"<\/p>\n
To prevent PHP scripts from accessing files between domains, you would need one of the following:<\/p>\n
1) to create the domains as separate CPANEL accounts. This requires root access to the server (i.e. VPS or Dedicated), or a RESELLER <\/b>account(that has access to WHM),\u00a0from where you can create separate accounts, and then host only 1 domain in one account.<\/p>\n
2) Some people say (but I have not tested personally) is to have DirectAdmin <\/a>(several hosting companies offer that). You can create subdomains under different User accounts<\/b>, so each sub.domain.com User can have their own DirectAdmin User account (You’d just enter domain=sub.domain.com for each User).<\/p>\n
3) Best thing – obtain a hosting, where the domains are added in separate, restricted root\u00a0directories (some hosting companies have such system).\u00a0 You can find out the list here : Comparison of secure hosting companies<\/a><\/b><\/p>\n
4) Another useful trick: If you want to use WordPress<\/a> <\/span>CMS and under your server, which you want give them to other people (and dont want to fear of them, hacking your site) then\u00a0give other people only “AUTHOR<\/strong>” role-users. So, you will be safer.\u00a0 \u00a0(About WordPress –\u00a0 you should also review Must-Have WordPress Plugins<\/strong><\/a> (especially, read the “Guard<\/strong><\/span>” plugins) to even secure your individual websites.\u00a0You should install several plugins, like\u00a0\u00a0iThemes Security, Sucuri<\/b>, BlackBots and etc,,)<\/b><\/p>\n<\/div>","protected":false},"excerpt":{"rendered":"
Security problems with cPanel ! Pre-amble I think it is the HIGHEST-LEVEL security matter for EVERYONE, WHO HAVE A WEBSITE.\u00a0Probably everyone knows – when you host multiple domains in cPanel,(Continue Reading)<\/a><\/p>\n<\/div>","protected":false},"author":1,"featured_media":1650,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[13],"tags":[],"class_list":["post-290","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-website"],"_links":{"self":[{"href":"https:\/\/puvox.software\/blog\/wp-json\/wp\/v2\/posts\/290","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/puvox.software\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/puvox.software\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/puvox.software\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/puvox.software\/blog\/wp-json\/wp\/v2\/comments?post=290"}],"version-history":[{"count":0,"href":"https:\/\/puvox.software\/blog\/wp-json\/wp\/v2\/posts\/290\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/puvox.software\/blog\/wp-json\/wp\/v2\/media\/1650"}],"wp:attachment":[{"href":"https:\/\/puvox.software\/blog\/wp-json\/wp\/v2\/media?parent=290"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/puvox.software\/blog\/wp-json\/wp\/v2\/categories?post=290"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/puvox.software\/blog\/wp-json\/wp\/v2\/tags?post=290"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}