Permissions on site

Hi,

once i have the site as is, what are the most secure permissions to use on each folder?

would 444 be the best for files with a few exceptions? what exception will they be?

my site does not have any uploads or downloads, i will upload images via ssh/sftp, so will give myself the correct permissions as i need them.

can i get away with 400 for both configure.php files?

is there anything else i can do on a file level that will aid the security of my site?

is there anything database level i need to consider?

I'm just thinking about this as i want to minimise the attack surface of my site.

Many Thanks

Alan

755 for directories
644 for files

As you will be changing permissions as needed at the time, you can use the above for most anything. Very secure and no problems for Visitors accessing what they need.

For yourself when working in the Admin section and/or using the Template overrides, you will definitely need to change permissions but in some areas, you can leave permissions a little bit more open. Visit this thread for more info, Template overrides clarification.

wouldn't having 644 open me up to potential attacks? as the files will be writeable by the owner (my account)

just thinking about any theoretical apache attacks

Alan

Just an advice for who is using linux or unix servers= with my experience i would recomend to use only windows if youre using zen or cubecart ,, for oscommerce its ok because i was first using windows without problem but wen i changed to a linux server i get all type of permission dinied error but some only fix wen i use 077 permisions while some will only apcept 777 and some 644 and belive it or not= some i have not yet managed to fix

NOTE: You have much less control on windows servers than on unix servers ...

Zen Cart is best used on unix servers, not on windows servers ...