Unable to secure WordPress instance: Permissions for files and directories still marked as Not Secure

Symptoms

• When clicking the Secure button in Plesk at Domains > example.com > Check Security nothing happens: There is still a red exclamation mark next to Permissions for files and directories.

• There are several files or directories inside a domain document root directory that do not belong to the psacln group:

  # find /var/www/vhosts/example.com/httpdocs/* ! -group psacln
  drwxr-xr-x. 9 sysuser apache 4096 Aug 11 2016 wp-admin
  -rw-r--r--. 1 sysuser apache 4035 Sep 18 2015 wp-trackback.php

Cause

Incorrect ownership: all files and directories under a domain document root directory should belong to psacln group.

Resolution

1. Connect to the Plesk server using SSH.

2. Modify the ownership for all files and directories inside domain's document root:

   # chown -R :psacln /var/www/vhosts/example.com/httpdocs/*

   If the subdomain is affected:

   # chown -R :psacln /var/www/vhosts/example.com/subdom.example.com/*

3. Set group ownership for httpdocs directory itself to psaserv:

   # chown :psaserv /var/www/vhosts/example.com/httpdocs

   If the subdomain is affected:

   # chown :psaserv /var/www/vhosts/example.com/subdom.example.com/