How DooFiles protects your site

Overview

A file manager can change any file of your site, including its code. That is what makes it useful, and also what makes it a target. DooFiles is built so that a stolen session, a mistake or a malicious file can do as little damage as possible.

This page explains each layer of protection in plain terms. Each one links to its own page.

Who can use DooFiles

• Only administrators. DooFiles opens only for users with the Administrator role, or network administrators on a multisite network. Editors, authors and other roles cannot use it, even if another plugin gives them extra permissions by mistake.
• Only from its own screen. DooFiles works only from DooFiles › File manager, in a signed-in browser. Application passwords, scripts and other tools that can reach your site cannot use it. The one exception is a device you connect with Mobile access, which only opens your private folders.
• Only through WordPress. No file of the plugin does anything when someone opens it directly from the web. Every action goes through WordPress, which checks who is asking first.

Every attempt by a user who is not allowed is recorded in the Activity log.

Where DooFiles works

DooFiles works only inside the folder where WordPress is installed. It never shows, opens or changes anything outside it, and it ignores shortcuts (symbolic links) that point to other places on your server.

Before changing code

• Password confirmation. Changing PHP files, server files such as .htaccess or wp-config.php, or folders asks for your WordPress password first. Someone who steals your session can browse files, but cannot change code without your password. After five wrong passwords in a row, the confirmation locks for 15 minutes. See Password confirmation.
• Second factor. You can also ask for a 6-digit code from an authenticator app, and require it for every administrator. See Second factor.
• Warnings for what WordPress needs. Moving, renaming or deleting the files of WordPress, wp-config.php, its folders or the active plugins and theme, or adding files inside wp-admin or wp-includes, asks you to confirm first. An accidental drag cannot break your site. See Manage files.
• DooFiles protects its own folder. It is marked protected in the file list, and it cannot be moved, renamed or deleted from DooFiles, nor can a folder that holds it, even with your password. To remove DooFiles, deactivate and delete it in Plugins (DooFiles 1.0.11 or newer).
• Read-only mode. When nobody needs to change files, turn on read-only mode: DooFiles still lets you browse, view and download, but changes nothing. See Read-only mode.

Safe saves

When you save a file in the editor, DooFiles:

• checks the syntax of PHP files first, so a typo does not break your site;
• warns you if someone else changed the file after you opened it, instead of overwriting their changes;
• keeps the previous version as a backup, so you can go back.

Safe uploads and zip files

• Uploads of PHP and server files ask for your password before anything is sent. See Uploads.
• Zip files are checked before they are extracted. DooFiles refuses archives that try to write outside their folder, never overwrites an existing file, and limits how many files an archive can have and how much space it can take once extracted. See Manage files.

Safe previews

• Images, videos and PDF files are shown as what their extension says they are, never as a page that could run code. An image with hidden scripts cannot run them, even if someone opens its address directly.
• The preview of Markdown and HTML files never runs scripts. See Editor.

Private folders

You can close a folder of your own to the web, so nobody can open its files by address, and choose which administrators can open it in DooFiles. DooFiles checks with a real request that your server keeps it closed, and checks it again every day. See Private folders.

Mobile access

Administrators can open their private folders from a phone or tablet, with the DooFiles app. It is off until an administrator turns it on for the site. Connecting a device asks for the password and the second factor, and shows a code that works once. A connected device only reaches the private folders that have its administrator on their list, and never uploads or changes PHP or server files. It can only create folders, rename, move and send files to the Trash if the site allows it, and it can never empty the Trash. Each device can be disconnected at any time, and changing the password disconnects them all. Your files go straight from your site to the device, never through Doothemes. See Mobile access.

The Trash and the backups are protected

The Trash and the backups live in a private folder of DooFiles, with a random name, closed to the web. A deleted PHP file or server file cannot run while it is in the Trash, even on servers that ignore .htaccess.

Original files

With each scan of the Space view, DooFiles checks that the files of WordPress, of your plugins from WordPress.org and of the products of Doothemes are the original ones, and lists the files that were modified, are missing, or are extra in wp-admin and wp-includes, the usual sign of malware. It only reads them. See File integrity.

Everything is recorded

The Activity log records every action done with DooFiles, with the user, the date and the IP address, including the attempts that DooFiles blocked. It cannot be emptied from DooFiles, so nobody can erase what they did.

Your files stay on your server

DooFiles never sends your files, your users or your content to Doothemes. To activate and check your license and look for updates, it sends only your license key, the address of your site and the version of the plugin.

What DooFiles cannot protect against

• An administrator with their password. An administrator who confirms their password can change any file inside the folder of WordPress. That is the purpose of a file manager. On sites where nobody should change code, use read-only mode.
• Your server permissions. DooFiles can do exactly what PHP is allowed to do on your server, no more and no less.
• Other ways into your server. DooFiles does not control FTP, SSH, the file manager of your hosting, or other plugins.
• Mistakes outside DooFiles. It keeps backups of what it changes, not of your whole site.

Recommendations

• Use a strong, unique password for every administrator, and turn on the second factor.
• Give the Administrator role only to people who need it.
• Keep WordPress, PHP, your plugins and your themes up to date.
• Keep regular backups of your whole site, files and database, with your hosting or a backup plugin.
• Turn on read-only mode on sites where files rarely change.
• Look at the Activity log from time to time, especially for failed password confirmations.
• Use HTTPS on your site.

Report a security problem

If you find a security vulnerability in DooFiles, please report it privately by opening a support ticket, and do not share it publicly until we have had time to fix it.