Overview
You can secure your DreamHost website by setting correct file and directory permissions, adding an SSL certificate, granting developers only the access they need, assigning a unique user to each domain, connecting with SSH or SFTP, keeping your software updated, and protecting database access. This article explains each of these methods.
How do I configure permissions and access?
The following explains how to set permissions on your website's directories and files, add an SSL certificate, and decide what access to grant to a developer.
How do I set file permissions?
When setting up file permissions, DreamHost recommends that you set the permissions to the following:
- Files – Set to 644 permissions using the command chmod 644 <filename>
- Directories – Set to 755 permissions using the command chmod 755 <directory_name>
- Executables – Set to 755 permissions using the command chmod 755 <executable_name>
Here is an example of how your file/folder permissions should look on the server after running ls -la.
[server]$ ls -la drwxr-xr-x 2 exampleuser pg5034488 10 Apr 22 09:13 example_directory -rw-r--r-- 1 exampleuser pg5034488 0 Apr 22 09:12 example_file.php
Why should I use an SSL certificate?
An SSL certificate should be used on all websites to ensure data is transmitted securely. DreamHost offers both free and paid (professionally-signed) options.
How do I allow developer access to my site?
It may be necessary at some point to hire a developer to work on your website. There are a few different ways a developer may require access to your site in order to work on it. The access you grant a developer depends on exactly what tools they need to complete the job you hired them for.
See this article for information on how to grant your developer only the specific access they require.
How do I manage my website content?
This section provides suggestions on securing access to your website and its data.
Why assign a unique user to each domain?
DreamHost recommends that you assign a unique web user to each of your individual websites. The reason for this is that if one of your sites becomes compromised, the exploit won't expand to your other sites. See the One user per domain policy article for more information on how each user only has access to the content under their own directory.
How do I connect using a secure client?
When connecting to your server to manage your files, DreamHost recommends that you use either SSH or SFTP (using port #22).
An FTP connection (using port #21) is not secure and should never be used.
Why should I keep software updated?
Always ensure that the software your website uses is up to date.
Websites are often hacked via security holes found in old versions of web software, such as web forums, wikis, and blogs. It's your responsibility to keep the website application updated with the latest version.
Some applications do not provide an upgrade path from older versions, which will then need to be updated manually. Check with the application’s developers for further assistance on upgrading.
How do I secure database access?
See this article for information on securing how your database is accessed.
This is very important as your database holds all of your website's data and configuration details. Failure to protect it could expose private information such as usernames, email addresses, and more.