.htaccess is writable

  • Resolved norsubs

    (@norsubs)


    1 year ago

    Hi.

    As I use the plugin LiteSpeed Cache I need the .htaccess to be writable (644).

    But the Loginizer Security suggest to change it to 0444

    The problem then, is that LiteSpeed Cache does not work properly.

    Is there a big risk to leave it at 644?

    Thanks,

    NorSubs

Viewing 6 replies - 1 through 6 (of 6 total)
  • Plugin Support Vardan

    (@vardan05)

    1 year ago

    Hello,

    It will be fine to use 644, having 0444 is a suggestion as it makes the file read only, but if setting 0444 is causing issues with your server, then you should keep the htaccess permission to 644.
    What 644 means is that only the file owner can read and write the file; other user types can only read it, so setting 644 will be fine as well.

    Regards,
    Vardan

    Thread Starter norsubs

    (@norsubs)

    1 year ago

    Great! 🙂

    Thanks,

    NorSubs

    seanmaskey

    (@seanmaskey)

    11 months, 1 week ago

    similar question – site has had some bot activity that created user organiser roles & some venues & organisations.

    loginizer reports /wp-config.php &  htaccess as writable & 0640. how do I know if system requires that ability? wordfence has just written to htaccess, so presumably it is necessary.

    thanks

    S

    Plugin Support Vardan

    (@vardan05)

    11 months, 1 week ago

    Hello @seanmaskey ,

    As mentioned in earlier response. These are suggestions, setting those permissions surely will make the files not writable, which means if you are using plugins that require need to update htaccess file, if the permissions are changed you will have to manually update the file. You need to decide between convenience v/s security. Although having permission of 644 is safe too. 0444 would be an ideal state, where plugins can only read the file.
    For the issue you are facing due to random account creation, make sure to reset your account passwords and in the bruteforce logs see if the attack is happening on xml-rpc if yes it would be best to disable XML-RPC.

    Regards,
    Vardan

    seanmaskey

    (@seanmaskey)

    11 months, 1 week ago

    Thanks – that’s very clear & helpful.

    loginizer logs are only showing last 24 hrs; can I access older ones?

    is there a way to tell if xmlrpc is being used on the site?

    thanks

    s

    Plugin Support Vardan

    (@vardan05)

    11 months, 1 week ago

    Hello @seanmaskey

    Loginizer just stores logs of 24 hours, and to know where the attack is happening in the logs you can check the coloumn named URL Attacked it is the last column in the Loginizer Bruteforce logs.
    And if you want to continue with this disucssion I would request you to create a new thread as the issue we are discussing now is different from what the topic is for.

    Regards,
    Vardan

Viewing 6 replies - 1 through 6 (of 6 total)

The topic ‘.htaccess is writable’ is closed to new replies.