I have an Ubuntu server with NGINX/PHP/MySQL with multiple website hosted on it.

Several of them are Wordpress websites for friends, so they can upload their own plugins and potentially malicious code.

How can I prevent scripts in their web folders from accessing other website folders and my home folder?

  • This is most likely going to end in disaster and will take a fair amount of setup and maintenance, because you will have to isolate both the website files and databases for each friend. Are these just hobby sites? Would your friends care if you had to wipe the machine and start over after their "own plugins and potentially malicious code" produce the expected outcome? You are probably better off putting them on individual cheap VPSs and let someone more experienced worry about it. Commented Mar 1, 2016 at 15:08
  • @TomBrossman - That's fine. Can you tell me how to isolate the web files? Databases will just be owned by different mysql users.
    – jetlej
    Commented Mar 1, 2016 at 20:59
  • 1
    See this canonical question for an overview of file/folder permissions and groups, users, etc. It can be done because this is how shared hosting companies do it but they have more time and expertise and get paid to deal with this. You have to secure the whole stack and constantly maintain it for your friends' hobby websites. Nice thing to offer, but maybe not worth the trouble long term. Commented Mar 3, 2016 at 10:25

2 Answers 2


Just create new account and install WordPress separately.

Each WordPress site using separate database from phpmyadmin, so If your friends are not developer, then allowing FTP access is not good idea at all, they can do many things directly from WordPress dashboard.

  • I'm not concerned about my friends messing around, I'm concerned about malicious code jumping back 2 directories and affecting other sites.
    – jetlej
    Commented Mar 1, 2016 at 20:58

My answer for NGINX was to create php-fpm pools for each site/virtual host.

These pools each have their own user, and that use has no access to any files outside of the pool. So they are totally isolated.

Here is an in-depth tutorial


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.