Unable to secure WordPress instance: Permissions for files and directories still marked as Not Secure

Symptoms

• When clicking the Secure button in Plesk at Domains > example.com > Check Security nothing happens: There is still a red exclamation mark next to Permissions for files and directories.

• There are several files or directories inside a domain document root directory that do not belong to the psacln group and/or to the sysuser user:

  # find /var/www/vhosts/example.com/httpdocs/* ! -group psacln
  drwxr-xr-x. 9 sysuser apache 4096 Aug 11 2016 wp-admin
  -rw-r--r--. 1 apache apache 4035 Sep 18 2015 wp-trackback.php

Cause

Incorrect ownership: all files and directories under a domain document root directory should belong to psacln group and to the sysuser user.

Resolution

1. Connect to the Plesk server using SSH.

2. Modify the ownership for all files and directories inside domain's document root:

   # chown -R sysuser:psacln /var/www/vhosts/example.com/httpdocs/*

   If the subdomain is affected:

   # chown -R sysuser:psacln  /var/www/vhosts/example.com/subdom.example.com/*

3. Set group ownership for httpdocs directory itself to psaserv:

   # chown sysuser:psacln  /var/www/vhosts/example.com/httpdocs

   If the subdomain is affected:

   # chown sysuser:psacln  /var/www/vhosts/example.com/subdom.example.com/