Resolved Keep applying security measures to same two sites [how to create a persistent configuration]

[lightingman2003]

Server operating system version

Ubuntu 22.04 LTS

Plesk version and microupdate number

18.0.53 Update #2

We use WP Toolkit to keep our WordPress sites upto date and secure.

However, there are two of our sites where I keep needing to re-apply the "Restrict access to files and directories" security measure.

Its probably the fourth or fifth time in a few months where WP Toolkit marks these two sites as unsecure, and when I look it always flags "Restrict access to files and directories" as not being secure, despite me applying the security measure each time, and each time its always marked with a green tick following the measure being applied.

How can this be? Is there anything we can do to stop this once and forall? Its getting quite annoying having to keep re-applying this measure.

Thanks

 

[Evgeny]

I have faced this issue some time ago. The root cause was that a WP plugin creates files and give excess file permissions explicitly. or any 3rdparty software may do the same things.
I can advice you to check files and find which file or directory has a strange permission and that file may point to a plugin.

This security measure sets the permissions for the wp-config file to 600, for other files to 644, and for directories to 755.

at the time, WPTK cannot be able to re-apply this measure.

 

[lightingman2003]

Thanks for your reply. I've had a look at the structure of both of the offending Domains, and spotted two folders with wierd permissions being set on both:

drwxr-xrwx  3 xxxx psacln   4096 Feb  2 18:57 blogs
drwxr-xrwx  2 xxxx psacln   4096 Feb  5 04:05 tmp

Based on my calculations, these folders have a permission of 757 (not 755), and both of these folders dont actually have any valid content in them, apart from an empty file named '.hidden'.

Could this be causing our issue?

 

[Evgeny]

Yes, it can cause this issue. So if you fix these permission and then something recreates these folders with excess permissions - the issue will reappear.

 

[orenk]

I have the same problem, how can I find which folders and files does not have the correct permissions ?