Keep every layer supportable
The CMS, PHP runtime, web server, database and operating system each have their own support lifecycle. An application update may also change runtime requirements. Maintain an inventory and test upgrades before a layer reaches end of support.
Practical controls
Application
- Apply core and extension security releases.
- Remove abandoned or unused packages.
- Validate uploads and untrusted input.
- Use unique salts, keys and database credentials.
Hosting
- Keep production errors out of public responses.
- Use least-privilege file and database access.
- Prevent PHP execution in upload directories.
- Back up off-site and test restoration.
Permissions are not a universal recipe
Directories set to 755 and files set to 644 are a common shared-hosting baseline, but ownership and server configuration determine whether those values are appropriate. Avoid world-writable 777 permissions. Sensitive configuration should receive narrower access where the host supports it.
Frequently asked questions
Are 755 directories and 644 files always secure?
They are common starting values, not a universal guarantee. Correct ownership, server user separation and protection of sensitive configuration also matter.
Should PHP errors be disabled?
Detailed errors should not be displayed to public visitors in production. Errors should still be logged securely so maintainers can investigate them.