2

I am running my wordpress website under Ubuntu server and the .htaccess file keeps changing every week. Now I would like to make .htaccess impossible to be modified by anyone whatsoever. I tried chmod 444 and 404 but to no avail.

Could you please suggest a better solution, because I have been struggling with this for nearly 2 months now...

  • And the changes are ... normal changes done by Apache? ... not normal changes done by Apache? Got an example of those changes for us? – Rinzwind May 17 '15 at 11:47
  • Yes, Wordpress htaccess gets reset to the default one that comes with wordpress. and since the website is installed in a folder, that default htaccess breaks the website links. – MrJack Mcfreder May 17 '15 at 19:08
3

As long as there's anyone who has root access to the server, you cannot achieve this. With root access any file can be changed no matter what permissions or ownership you apply.

  • I am the only one who can login to the root – MrJack Mcfreder May 16 '15 at 22:26
  • That's not what I meant. Root access is not the same as becoming root on a webserver. If someone or some software like for example the webserver has access and write permissions to the root where .htaccess resides then it/he/she can change that file. This can be a regular user of your Wordpress site if the site has inappropriate permissions. The .htaccess file is hidden and does not spontaneously change. To begin with remove all write permissions for anyone including the fileowner from this file. – wie5Ooma May 16 '15 at 23:15
  • Thank you for your feedback. Do you mean I need to change the file ownership using chown command ? – MrJack Mcfreder May 17 '15 at 16:29
  • @MrJackMcfreder yes change the owner and group with chown. You can also mark the file as 500 with chmod (the 0 makes it impossible for anyone to do anything that is not the user). – Rinzwind May 17 '15 at 21:11
  • Thank you very much for you help!! I will try that and come back week later and let you know if it works ;) – MrJack Mcfreder May 17 '15 at 21:52
2

If you want to make a file immutable (prevent it from getting modified) you can use the chattr command to do that.

sudo chattr +i <filename>
  • Thanks for the suggestion. I have tried something similar which is changing group and user permissions but it made my server crashed because of high load. The malware kept attempting to modify htaccess over and over. Best cure was to eliminate the malware and with that the problem disappeared. – MrJack Mcfreder Sep 22 '15 at 14:48
  • Hey, while we're on the subject, could you please share the malware code? I'm doing a research on it. It would be really awesome if you could share it. – Root Sep 22 '15 at 14:58
0

I run a malware scan with ClamAv and it found many malwares hidden in all my wordpress websites themes. Then I did Re-Update of all my wordpress code files and It's solved.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.