Applying the principle of least privilege for improved WordPress security

The principle of least privilege is an important security measure. Even so, it often does not get the attention it deserves. With breaches, data loss, and DDoS attacks on the rise, it is high time we shine a spotlight on this security best practice for WordPress.
In this blog post, we first define the principle of least privilege, then examine when and where it applies, the risks of not adopting it, and why many website developers still do not build it into their WordPress websites. We also share some practical recommendations so that you can immediately begin to improve the security of your WordPress websites.

What is the Principle of Least Privilege?

The idea is very simple: do not grant a user account, process, or program more access rights than it needs to accomplish its designated tasks. In doing so, we:

• Limit any possible unintended damage
• Reduce the attack surface in the event of a breach
• Facilitate compliance with regulatory standards

When it comes to WordPress websites, the principle of least privilege primarily applies to users. Think of your editors, shop managers, authors, contributors, and other users—all of whom have different jobs and work on different tasks.

In this case, we need to ensure users are assigned roles that include capabilities that allow them to do their jobs- no more, no less. So, for example, we want contributors to be able to create and save new posts; however, we might want to limit the publishing capability to editors. By the same measure, editors should be able to edit and publish posts, but should not have administrator privileges since this goes beyond the scope of their activities.

The principle of least privilege (PoLP) is also known as the ‘principle of least authority’, the ‘principle of minimal privileges’, or the ‘least privileged user account’ (LUA).

What are the risks if PoLP is not applied?

Controlling access to certain areas of your WordPress site seems a no-brainer. Otherwise, aren’t you leaving the website entirely at the whim of any logged-in user? In some cases, users may not even be aware they’ve made a mistake or any unintended outcomes.

Think of the following possible scenarios:

• A new user with little understanding of the business implications, such as the implications of downloading new WordPress versions or plugins without first making a backup
• Those with limited security awareness creating new users or changing permissions of existing users
• Those who don’t know how to deal with errors or other issues
• External blog post contributors, who may download or update plugins on your website, without asking

It also means your entire WordPress backend is at risk of an unauthorized person adding new users and giving them access to areas of the website where they can cause deliberate harm.

A security breach can potentially have far worse consequences if the principle of least privilege is not applied. While any account can suffer a breach, having more accounts with administrator access increases your attack surface and the likelihood that a breach will result in:

• Altering themes, customized features, or public-facing website content
• Mishandling stock, SKUs, or product metadata on e-commerce stores
• Offering unauthorized discounts
• Accessing, changing, downloading, or deleting code, page templates, media, configurations, or staff, customer, and other types of files
• Accessing company, customer, health, or financial data, for example, to misuse or sell to other nefarious parties
• Taking the site and its products or services offline

TIP: Use an activity log plugin for WordPress to keep a log of all the changes that users make on your WordPress website. It helps with user accountability and eases troubleshooting.

How to apply the principle of least privilege for WordPress

Now that you’re focused on improving your security posture, this section provides a list of where and how the principle of least privilege can be applied on a WordPress website or blog. The good news is that you can significantly enhance security without having to modify site settings, making the principle of least privilege a low-hanging fruit that anyone can apply.

WordPress user roles and privileges

WordPress users make mistakes – even administrators. And, users also like to explore settings and configurations. If you assign users roles with administrative access, the more curious among them will most likely take advantage of their newfound powers. This can potentially result in an unintentional change in user experience, such as a change in the website’s functionality.

WordPress has several built-in user roles and connected capabilities, listed below (from most to least).

Super Admin

The Super Admin role is only available on multi-site networks and provides admin access across all sites in the network.

Administrator

The Administrator role represents the highest access level on WordPress sites. It is intended for site owners and administrators responsible for managing the entire site. While developers are usually included in this group, this is not always the case. For example, if the developer does not need to manage users and content, the principle of least privilege tells us to create a separate role. We will discuss this in more detail later.

Editor

The Editor role represents a relatively high level of access with sweeping rights when it comes to content. Editors can manage and publish posts, including posts of other users, categories, links, and tags. They can also moderate comments.

Author

The Author role can be thought of as one with medium access levels. Authors can manage and publish their own posts and upload media files.

Contributor

The Contributor role is fairly low-level, allowing users to write and edit their own posts, but not publish them.

Subscriber

Understanding how roles work in practice is crucial for implementing the principle of least privilege. For example, while a Contributor and Author may share some capabilities (e.g. edit posts and delete posts), a Contributor is unable to do everything an Author can, such as upload files or create usable blocks.

Creating custom roles

If the current selection of WordPress user roles does not satisfy your requirements, you can easily create custom roles using our own Melapress Role Editor plugin.

Step 1: Installing the plugin

Navigate to Plugins > Add Plugin and search for Melapress Role Editor. Next, click on Install Now, and once the plugin has finished installing, click on Activate.

Step 2: Configuring the plugin

Once the plugin is activated, the initial configuration wizard will automatically kick in. Here, you’ll have two options: Create a new role or Show me all the roles on this website. Melapress Role Editor comes with a number of pre-configured WordPress user roles based on common business functions to help you get started.

The plugin has an intuitive interface that makes creating custom roles easy. There is also a backup and restore function, as well as a reset default roles option to help you make sure you can revert any changes you make.

Creating temporary logins

If you need to grant users temporary access to your WordPress site, temporary logins are a great way to ensure you meet the principle of least privilege on WordPress. Temporary logins are user accounts that have a preset expiration date. On the set date, the account will automatically lock out

Do keep in mind that you will still need the appropriate roles set up beforehand.

You can easily set up WordPress temporary logins using the free edition of Melapress Login Security.

WordPress database user privileges

WordPress uses MySQL to store various settings and configurations. The principle of least privilege applies just as much here, with different permissions required for day-to-day operations and one-offs such as updates requiring database modifications.

For normal daily WordPress operations, such as writing and publishing of content, the WordPress database user only needs the following privileges to enable them to manage the data from within the database:

• Select
• Insert
• Update
• Delete

These permissions do not allow the WordPress database user to modify the database structure. However, certain updates might need additional privileges to modify the database. These privileges include:

• Create
• Alter
• Drop

Privileges such as Drop, which allows you to delete the database, are very sensitive. As such, you should be very strict about assigning such permissions.

Recommendations

In an ideal environment, to harden the security of your WordPress website or blog, you should configure secure and restrictive WordPress MySQL database privileges. Only revert to assigning all privileges to users who need to install a new plugin that creates new tables in the database, or when WordPress has been updated and there are changes to the WordPress database schema.

Another recommendation is to avoid granting access to databases other than the WordPress one for the relevant website.

Files and directories permissions

It is easy to configure file and directory permissions. You’ll find ample online documentation explaining how to harden the permissions of your WordPress installation. While WordPress runs on any OS that runs PHP, Linux is by far the most commonly used. In terms of groups, Linux has three permission groups:

• Owner: Owner of the file/directory, whose permissions neither apply to nor affect any other users
• Group: Group of users that have been assigned access to the file/directory, whose permissions neither apply to nor affect any users outside the group
• Other: The permissions levels everyone else has to the same file/directory

Each of these is assigned Read (view the contents), Write (write or modify the contents), or Execute (run the contents, such as a script) permission. These permissions are stored as a series of numbers, and they give access to PHP code, images, and other media, as well as HTML and JavaScript files and plugins.

The implication of assigning the wrong permissions to the wrong permission group could mean that a malicious hacker could take advantage and result in a low-level vulnerability spiralling into an unacceptable risk.

Recommendations

If you’re on a managed WordPress hosting plan, your hosting provider will typically handle all file permissions for you. However, if you’re installing your own WordPress, you should use the PoLP, configuring the least possible file and directory permissions for WordPress to work.

Remember that by hardening the file and directory permissions, you might also restrict some WordPress plugins from functioning. As explained earlier, you might be installing plugins that need to store data in their installation directory. If so, do not simply configure 777 permissions to the plugin directory (full read, write, and execute to anyone with permissions to control it). That is the easy way out. But you should also avoid limiting it so far that it prevents the relevant users from updating WordPress, its themes, and plugins from the web UI.For further information, see WordPress file permissions: the guide to configuring secure website & web server permissions.

WordPress admin and plugins configuration

Not all administrators require access to the same privileges. Like many systems and networks, it’s common to have a lead admin among a group of WordPress administrators.

Understanding what each admin does enables you to ensure the correct access levels for each one. This is also very important if you store sensitive data and want to comply with regulations such as HIPAA and GDPR.

Recommendations

Just because someone is an administrator, it does not mean they need to have an administrator account. Using Melapress Role Editor, which we discussed previously, you can create multiple administrator roles with the right user access so that everyone can do their job.

WordPress security plugins usually also allow you to restrict access to other WordPress administrators. Making use of such features seems like a small but sometimes overlooked control that will help you comply with the PoLP.

FTP access for third-party contractors

When you hire a designer, developer, or a plugin’s support team that needs FTP access to your website, you might grant them full access to the root of your website, right? In most cases, this is unnecessary.

Recommendations

In the case of a designer, all they need access to is the theme’s directory, so restrict access to that directory. The same applies to plugin support teams and developers. Always restrict access to whatever the person needs to get the job done. If you’re unsure, ask the contractor for a list of folders and files, including an explanation of why access is required.

Using the Principle of Least Privilege for WordPress and beyond

The above is only a selection of the most common scenarios where the principle of least privilege for WordPress is often overlooked but can be easily applied.

In order to start adopting PoLP, begin by considering what you want to do about the following items:

• The web server
• The database
• Customizations

Don’t shy away from applying the principle of least privilege simply because things don’t work out straight away. Yes, most of the time you have to spend a few hours configuring customized user roles and troubleshooting plugins. Repackage this in your mind as a long-term investment in the security of your WordPress websites.