Getting Started with PmWiki: A Beginner’s Guide

Securing Your PmWiki: Best Practices and TipsPmWiki is a lightweight, file-based wiki engine popular for its simplicity, flexibility, and low server requirements. Because it stores pages as files and is often deployed on shared or small hosting environments, securing PmWiki requires attention to file permissions, extension management, authentication, and general web-server hardening. This article walks through practical, prioritized steps to make a PmWiki installation significantly more secure while preserving usability.

Why security matters for PmWiki

PmWiki installations often hold documentation, internal processes, and sometimes sensitive notes. A compromise can expose intellectual property, user credentials, or enable malicious content injection. Unlike heavier CMS platforms, PmWiki’s smaller codebase can make it easier to audit, but misconfigurations (file permissions, public write access, outdated recipes) remain common risks.

1. Keep PmWiki core and recipes up to date

Apply updates promptly. Regularly check the official PmWiki site and your recipes’ sources for security patches and bug fixes.
Track versions. Record the PmWiki core version and the versions of installed recipes; this helps identify when updates are needed.
Avoid installing unmaintained or obscure recipes; prefer those with active maintenance and community review.

2. Secure file permissions and ownership

Ensure the web server user (e.g., www-data, apache, nginx) has only the necessary permissions:
- PmWiki files should typically be readable by the web server but writable only where needed (the data/ directory, local/config.php, and any directories used for uploads).
- Set directories to 755 and files to 644 as a baseline; more restrictive settings are better where possible.
For directories that must be writable (data/ and attachments/ by default), limit write permissions to the web server user and avoid world-writable (777) permissions.
If possible, run the web server under a dedicated user and group to isolate PmWiki from other services.

3. Protect configuration and sensitive files

Move sensitive configuration out of web-accessible directories if your hosting setup permits.
Protect local/config.php and config.php by restricting access via .htaccess or web server rules:
- Example (Apache):
```
<Files "config.php"> Require all denied </Files> 
```
Prevent direct access to PmWiki data files by denying access to files with certain extensions or directories, or by placing them outside the document root when feasible.

4. Harden web server settings

Use HTTPS (TLS) for all traffic. Obtain a certificate (Let’s Encrypt is a free option) and redirect HTTP to HTTPS.
Disable unnecessary HTTP methods (e.g., TRACE, TRACK). Allow only GET, POST, HEAD, OPTIONS as required.
Implement security headers:
- Content-Security-Policy (CSP) — reduce risk of XSS.
- X-Frame-Options: DENY or SAMEORIGIN — prevent clickjacking.
- X-Content-Type-Options: nosniff — prevent MIME-type sniffing.
- Referrer-Policy and Permissions-Policy as appropriate.
Limit request sizes for uploads and forms to reasonable values to mitigate DoS via large payloads.

5. Configure PmWiki user authentication and access control

Decide the access model: public read vs. restricted read. Default PmWiki setups may allow public write; change this to require authentication for edits if needed.
Use PmWiki’s built-in authentication or integrate with external auth:
- HTTP Basic/Digest via web server.
- LDAP/Active Directory using available recipes.
- OAuth/OpenID Connect if you need third-party single sign-on.
Configure role-based access using PmWiki’s group and ACL settings. Limit administrative privileges to trusted accounts.
Enforce strong passwords and, where possible, enable multi-factor authentication (MFA) via SSO providers.

6. Disable or carefully vet writable page features

Turn off or restrict anonymous editing. Set default edit rights to authenticated users.
Limit file uploads to trusted user groups. Validate uploaded file types and store uploads outside the web root or use filename sanitization to prevent execution.
Disable or filter any HTML or raw PHP embedding features. Avoid running PHP from wiki pages.

7. Sanitize input and prevent code injection

Use PmWiki’s sanitization features and recipes that escape or remove dangerous HTML and JavaScript in user-submitted content.
Avoid enabling features that evaluate user-provided code or templates. If you must allow dynamic content, restrict who can use it.
Regularly scan pages for suspicious content, especially embedded scripts or iframes.

8. Protect against Cross-Site Request Forgery (CSRF)

PmWiki includes some protections (like edit tokens). Ensure they are enabled and functioning.
Require tokens for state-changing operations (edits, uploads, account changes).
Use SameSite cookies set to Lax or Strict for session cookies to reduce CSRF risk.

9. Monitor logs and enable alerts

Keep web server access and error logs enabled and review them regularly for suspicious activity (repeated POSTs, strange user agents, unusual IPs).
Monitor PmWiki’s own logs (if enabled) for failed logins, permission errors, or repeated edits from the same IP.
Set up basic alerting for large spikes in traffic, failed login attempts, or file upload patterns that suggest abuse.

10. Backup strategy and recovery planning

Schedule regular backups of the wiki’s data/ directory and any configuration files. Include attachments and local/custom recipes.
Store backups offsite and test restore procedures periodically to ensure backups are usable.
Maintain a changelog of major updates and an emergency contact/plan in case of compromise.

11. Limit exposure of sensitive metadata

Disable or limit public display of user emails, IP addresses, or other identifying info unless necessary.
Consider anonymizing or hiding contributor IPs from general viewers; keep them accessible only to admins.

12. Use secure hosting and network practices

Prefer VPS or dedicated hosting where you control server configuration over shared hosting when possible.
Apply OS and package updates promptly. Keep PHP up to date and use supported versions.
Use a firewall to restrict management ports (SSH) to known IPs and enable rate limiting for connections.

13. Audit installed recipes and plugins

Inventory all installed recipes and third-party scripts. Remove unused or unmaintained ones.
Review recipe code for insecure patterns (direct file writes, unsanitized input, eval-like functionality).
Subscribe to recipe mailing lists or check upstream repositories for security advisories.

14. Optional: Use a Web Application Firewall (WAF) or reverse proxy

A WAF can block common attack patterns (SQLi, XSS, known exploit signatures) before they reach PmWiki.
A reverse proxy (Cloudflare, nginx proxy) can provide rate limiting, IP reputation filtering, and caching to reduce load from abusive traffic.

Quick checklist (minimum recommended steps)

Enable HTTPS and redirect HTTP to HTTPS.
Restrict write/edit rights to authenticated users.
Set safe file permissions (avoid 777; writable only where necessary).
Keep PmWiki core and recipes updated.
Backup data regularly and test restores.
Harden web server with security headers and disabled unnecessary HTTP methods.

Conclusion

Securing PmWiki is about layering protections: keep the software current, restrict who can change content, harden the server environment, control file permissions, and monitor activity. Start with the quick checklist, then work through more advanced measures (WAF, SSO, recipe audits) as needed. With a disciplined approach, you can maintain PmWiki’s simplicity while keeping your wiki data safe.