The Door Even the Burglar Can't Open

The story behind my first WordPress plugin

A senior IT practitioner told me once about the Linux immutability feature that uses the binary chattr. In plain English, it can lock a file or folder so that it simply cannot be changed, not even by the main administrator account called the root account that has full access to Linux, so definitely not by any software or user account either, so this means if someone gained unauthorized access to a Linux server, they would not be able to make unauthorized changes to files or folders that had this protection set. That is like a door that is not able to be opened even if a thief somehow managed to get inside a house, they would not be able to remove or damage any furniture in the house.

System administrators have known about this for many years and have written their own scripts to use it. But that is exactly the limitation. Only technical persons can safely leverage this feature and if an organization uses this feature an ordinary staff member who wants to protect important files on a website would have to rely on a system administrator to do it for them which meant if that person was at lunch, vacation or just not available when they needed to make changes to that file(s), they could not do any work until they returned so very few organizations bother to use this feature.

I decided to find a way to make this feature easily accessible to non-technical persons and only required initial setup by that technical person, then they can give safe restricted access to certain non-technical persons so they could make the changes to do their work. So this would not be free-for-all, but a careful version, where selected people are allowed to harden only specific files and folders, with the right settings already in place to prevent mistakes or abuse, and with a log of who did what. The protection of the experts, without always needing them to be around and no more waiting on them to return.

I built it. The first version is a WordPress plugin, a proof of concept that I have already used on live production websites. It takes that old, trusted Linux feature and wraps it in something a normal person can actually use, with guardrails so it cannot be misused.

WordPress was only the starting point. The same idea is not limited to WordPress at all; it can be deployed for any website with on-demand features. I am planning other versions for different environments, like shared hosting, so the same kind of protection can reach more people in more places.

Good security is often about taking something powerful that's often restricted to the technical few and making it safely available to everyone. This adds one layer of protection for websites at the filesystem level so if the other measures fail we can still have some protection available.