I run a few WordPress instances. I had one new one that I had not configured and left sitting, so the installation was on the 1st step awaiting for the database name, username, password, and host. When I went to finish the install after letting it sit like that for a week, I had noticed that someone had found the site, and inputted their own database information, and "took the site over". It was a blank slate, so not much to it.

I removed the wp-config.php file and re-ran the installation with my own values. I then looked around for anything suspicious in the WordPress directory. I had found a shell plugin they installed, labeled "UBH console". I couldn't get the console to run, I got a 404 error.

I assume this shell couldn't get them access out into the machine past the www directory the website was installed in?

In the past, I've always set the WordPress directory permissions with the following command:

chown -R www-data:www-data directory/

Is this the right way to set these directories? Upon further research, a lot of people run this and stay like this, but I've heard to change your permissions after running the installation. Running Debian on my machine.

1 Answer 1


If you run the WordPress as user www-data, an attacker can do everything the user www-data can do. That's usually quite a lot:

  • Wide read access. You could test what you can access e.g. using sudo su -s /bin/bash www-data.
  • Write access to all the other sites run as www-data. You should treat every site as potentially compromised.

To prevent that in the future (not limited to these actions):

  • Run sites as separate users using PHP-FPM pools.
  • Chroot jail the web sites.
  • Disallow potentially dangerous PHP functions.
  • Do not leave copies of WordPress waiting for installation anywhere.
  • Keep WordPress and its plugins up-to-date.
  • Consider adding a web application firewall (WAF).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .