Best practices
As with any other part of the application, when you are dealing with security, there are some well-known best practices you need to follow or at least be aware of to avoid future issues. Here, you can find the most common ones related to web development.
File permissions and ownership
One of the most basic security mechanisms is file/folder permissions and ownership. Assuming that you are working on a Linux/Unix system, the main recommendation is to assign the ownership of your source code to the web server or PHP engine user. Regarding file permissions, you should be using the following setting:
500 permissions for directories (dr-x------): This setting prevents any accidental deletion or modification of files in the directory.
400 permissions for files (-r--------): This setting prevents any users from overwriting files.
700 permissions (drwx------): This is for any writable directories. It gives full control to the owner and is used in upload folders.
600 permissions (-rw...
