Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!

Spooky Wordpress plugin Wordfence scan telling whole disk space

Discussion in 'Security' started by whnewbie, Aug 4, 2014.

  1. whnewbie

    whnewbie Member

    Joined:
    Jan 1, 2012
    Messages:
    12
    Likes Received:
    0
    Trophy Points:
    51
    cPanel Access Level:
    Root Administrator
    My setup is cPanel / WHM 11.44 (latest), CloudLinux 6 (latest), Apache 2.4, Native PHP 5.4 (latest in EasyApache), CageFS and PHP Selector (CloudLinux)

    Just installed a Wordpress site and tried out a security plugin "Wordfence". During its "scan", I found that Wordfence could find out the disk space of the server and disk spaced used (and hence free disk space). This is rather spooky.

    I wonder how they manage to do this and wonder if this affects security of the server. Any way to prevent this is nice as I prefer more "privacy".

    Thanks.
     
    #1 whnewbie, Aug 4, 2014
  2. quizknows

    quizknows Well-Known Member

    Joined:
    Oct 20, 2009
    Messages:
    1,010
    Likes Received:
    87
    Trophy Points:
    78
    cPanel Access Level:
    DataCenter Provider
    Most standard system binaries like /bin/df are 755 permissions, so most users (including the usernames which execute apache and PHP) can run them. This is pretty normal.

    You could try restricting some of the more risky php functions by using the disable_functions setting in /usr/local/lib/php.ini. This can make it harder for php scripts to use system utilities. Mine is currently set to this:

    disable_functions = show_source,system,shell_exec,passthru,exec,phpinfo,popen,proc_open,allow_url_fopen

    Keep in mind this does not take into account that on most systems users can just set their own php.ini settings anyway, but there are other threads about stopping that ability.
     
    #2 quizknows, Aug 4, 2014
  3. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    43,870
    Likes Received:
    1,811
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #3 cPanelMichael, Aug 5, 2014
(You must log in or sign up to post here.)
Loading...
Similar Threads - Spooky Wordpress plugin
  1. Nabbello

    Caching Options for Wordpress?

    Nabbello, Jul 7, 2018, in forum: Workarounds and Optimization
    Replies:
    1
    Views:
    53
    cPanelLauren
    Jul 9, 2018 at 6:05 PM
  2. jlucho

    Suggestions MySQL for Wordpress

    jlucho, Jul 6, 2018, in forum: Workarounds and Optimization
    Replies:
    2
    Views:
    63
    cPanelLauren
    Jul 6, 2018
  3. Bidi

    Website Flood and with Wordpress PingBack

    Bidi, Jul 5, 2018, in forum: Security
    Replies:
    4
    Views:
    96
    Bidi
    Jul 9, 2018 at 11:23 AM
  4. mehdix92

    Mod_Security blocking WordPress logins

    mehdix92, Jun 13, 2018, in forum: Security
    Replies:
    3
    Views:
    178
    cPanelMichael
    Jun 14, 2018
  5. kdas77

    Using Wordpress in cPanel

    kdas77, Jun 5, 2018, in forum: Database Discussion
    Replies:
    3
    Views:
    83
    Infopro
    Jun 6, 2018

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...
    Dismiss Notice