---
title: "Understanding fortification"
date: "2016-06-17"
category: "control-panel"
slug: "understanding-fortification"
---

Fortification is a security feature in ApisCP that simplifies file permission management for PHP-based web applications. Because PHP runs as a separate user from your account, Fortification controls which files the web application can write to, limiting the damage an attacker can do if your site is compromised.

Manage Fortification via **Web** > **Web Apps** on any [[detecting-a-web-application]].

[![fortification-mode](kb-image:fortification-mode.png)](kb-image:fortification-mode.png)

## Benefits

### Limited Attack Surface

If your site is [[handling-a-hijacked-account]], an attacker's mobility is restricted. Backdoors are commonly installed in system files to maintain multiple re-entry points. Unless Fortification explicitly permits write access to those files, the attacker cannot install them. Writable paths (e.g., `/wp-content/uploads` for WordPress, `/administrator/cache` for Joomla) are further restricted by security policies to only serve static content like images and downloadable files.

### Damage Containment

Because PHP runs as a secondary user, an attacker cannot access your email, SSH keys, or control panel credentials. Damage is superficial, and the clear file ownership makes audit trails straightforward for rapid incident response.

### Important Caveat

Fortification helps keep your account secure, but does not replace good security practices. Keep applications updated, use strong passwords, and be selective with third-party plugins. Automatic updates are provided for WordPress, Joomla!, Drupal, and Magento, but thousands of other applications are not covered.

## Fortification Modes

### Learning Mode

Enabled for unrecognized applications or applications that have not been [[detecting-a-web-application]]. Allows 100% write access to the [[where-is-site-content-served-from]]. After 30 minutes, a background task analyzes which files were modified and creates a fortification profile, restricting future write access to only those files.

### Fortification On (MIN)

Minimum Fortification provides the most permissive write access. You should never need to manually change permissions, but an attacker would have access to more files, including the ability to alter your [[htaccess-guide]] file.

### Fortification On

Normal Fortification is the recommended maximum security level. Write access is limited to essential paths. You may need to temporarily enable _Web App Write Mode_ for tasks like installing plugins or running in-app updates. Most paths are filtered to serve assets as-is, reducing the ability for attackers to leverage secondary backdoors.

### Web App Write Mode

Temporarily disables fortification for 10 minutes, after which Normal Fortification is automatically re-enabled. Use this when installing plugins or performing in-place updates.

### Release Fortification

Completely disables fortification, granting the web application write access to every file on the site. This is generally very dangerous and should be used with extreme caution.

## Fortification Visualized

The following diagram illustrates Normal, Minimum, and Released fortification modes for WordPress:

[![fortification diagram-2](kb-image:fortification-diagram-2.png)](kb-image:fortification-diagram-2.png)

## See Also

- [Fortification](https://docs.apiscp.com/admin/Fortification/) (docs.apiscp.com)
