File permissions based security issues in Joomla

SiteGround utilizes Linux OS for all shared hosting servers and every file or folder in Linux has access permissions. There are three types of permissions (what is allowed to do with a file): 

  • read access - r
  • write access - w
  • execute access - e

Permissions are defined for three types of users: 

  • the owner of the file
  • the group that the owner belongs to
  • other users

Thus, Linux file permissions are nine bits of information (3 types x 3 type of users), each of them may have just one of two values: allowed or denied. Simply put, for each file it can be specified who can read or write from/to the file. For programs or scripts it also can be set if they are allowed to be executed.

One simple way to protect your script is to ensure that the correct permissions are applied to your files and folders. The following settings are the recommended permissions:

  • .htaccess file – 644 (Read and Write granted to you, Read-only to anyone else)
  • configuration.php (while site in development) – 644 (Read and Write granted to you, Read-only to anyone else)
  • configuration.php (when site is live) – 444 (Read access only)
  • Directories – 755 (Read/Write/Execute to you, Read and Execute to anyone else)
  • Files – 644 (Read/Write to you, Read-only to anyone else)

A common error is to make your templates folder world readable/writable (777). Although this directory contains your visual files, it is very important to have the right set of permissions. You should never set the permissions to be higher than 755.

Joomla is a powerful software that is easy to work with once you have the right host to support you. Before you lose any more time with the wrong host, check out the SiteGround Joomla hosting offer.

  • 0 Users Found This Useful
Was this answer helpful?

Related Articles

How to test if jHackGuard is working correctly on your Joomla site?

If you want to be sure that jHackGuard is installed and working correctly on your website, you...

How to remove time stamps from Joomla SEF URLs

Due to an incorrect alias or a non-English character in your category names, Joomla may replace...

How to configure AcyMailing to comply with hostlantern e-mail terms of use?

In order to comply with the SiteGround e-mail Terms of Service you have to configure your...

Joomla caching

The caching mechanism implemented in Joomla is a way to improve the performance and loading speed...

How to extract and restore a Joomla .jpa archive or backup?

Upload your .jpa archive in public_html through your FTP client:...