As the article suggests, it’s only a ‘possible’ permissions scheme. So there is no quick answer to ‘yes’ or ‘no’ in terms of settings the correct permission for files/folders in your particular hosting environment.
My suggestion is to keep it as ‘out-of-the-box’ unless you run into an issue which requires you to adjust permissions in order for particular feature (media upload) or plugins (caching) to work. You can also contact your hosting provider’s support ticket and have them run a security audit for you.
Related Posts:
- Securing a multi-user permission structure
- What permissions should I give directories if I want to make WordPress more secure?
- Definitive wordpress directory ownership and permissions on linux
- How to change permissions of WordPress and/or apache on macOS securely?
- On new server, site got hacked, permissions a bit strange? Please help
- Privilege escalation bugs in 2.9?
- wp-content – permissions for files/folders created by apache
- Avoid ‘uploads’ 777 permissions: Potential threat or clean solution?
- Folder Permissions + Security Concerns
- Malware/Permission bug removal?
- Default installation permissions for wp-config.php
- What’s the best approach for generating a new API key?
- Simplest two-way encryption using PHP
- How does the SQL injection from the “Bobby Tables” XKCD comic work?
- how fix “this certificate cannot be verified up to a trusted certification authority”
- How can bcrypt have built-in salts?
- Getting a List of Currently Available Roles on a WordPress Site?
- What’s the easiest way to stop WP from ever logging me out
- Prevent access or auto-delete readme.html, license.txt, wp-config-sample.php
- How safe / sanitized is wp_insert_posts()?
- From a security standpoint, should bloginfo() or get_bloginfo() be escaped?
- Why are passwords exportable as plain text in WordPress?
- What’s the difference between esc_* functions?
- How to set up fail2ban with WordFence?
- Is there a way to force ssl on certain pages
- What is the purpose of having a token in cookies?
- How to remove “Connection Information” requirement on localhost install of WP on MACOSX
- How is password strength calculated?
- File and directory permissions
- Regular security checks – what steps should be included?
- What are the pros and cons of using a custom front-end to retrieve content from a WordPress back-end
- What permissions does wp-content/uploads need?
- WordPress “Site Health Status” trust it or myself for its security advice?
- Do Cookies Need to be Sanatized Before Being Saved?
- Disable external access to REST API Endpoint
- What is the wp-includes/certificates/ca-bundle.crt used for?
- Do you need to escape hard coded plain text?
- Encrypt emails?
- WordPress salts set in config and database
- Disallow file edit not preventing plugin install
- How to secure WordPress XMLRPC?
- How can I find security hole in my wordpress site?
- Does WP show me if I’m logged in from multiple locations?
- Is it necessary to use esc_url with template tags such as get_permalink?
- HTTP Security Headers in wp-config
- WordPress Malware Problem help! [duplicate]
- Staging Site: Made Public – Security Questions
- Best Way to Enable Two Step Authentication
- Restrictive File Permissions
- Why are xmlrpc.php and wp-cron.php being called so often?
- Using esc_html with HTML purifier and CSSTidy: Overkill?
- wordfence scan warning on W3 Total Cache [closed]
- Is default functions like update_post_meta safe to use user inputs?
- No option “I would like my site to be private, visible only to users I choose” in Privacy Settings
- wp-config.php modified?
- Securing wp-config leads to sensitive information leak on wp-settings
- What’s the point of forbidding access to wp-config.php?
- How to save iframe tag into a post?
- wp-json and what data does it give away?
- Is is necessary to use security plugin for wordpress? [closed]
- Is wp_kses the right approach in sanitizing this string?
- Renaming install.php for security?
- WordPress Front end Form – Enable to Submit PHP Codes
- Is it safe use wp_editor in public contact form
- Which Versions of WordPress Ship with the Patched TimThumb?
- Use global variables or function that returns said variables for site-wide private-ish WP settings?
- How safe is current_user_can()?
- Is it safe to give wordpress directories ownership to www-data?
- Use Google authentication for pages within a website [closed]
- Do we need to escape data that we receive from theme options?
- Why does WordPress change a file’s permissions?
- Side effects of disallowing *.php requests in production environment?
- should I escape a literal url added in functions.php
- Outgoing new connection to linked Websites – why?
- My Site keeps crashing due to the wp-confg file being deleted
- Moving wp-config.php outside root folder where we have multiple wordpress websites for enhanced security [duplicate]
- Replace domain in database
- Adding Security Keys?
- What highest security brake with wordpress and static files?
- Secret keys in SCM
- Spam in WordPress root folder
- Uploading attachment (pdf) and prevent download for anonymous user
- Specific Page/Post Need to Stay Non SSL
- Scan multiple websites for malware that are in same webhost root?
- Security: AWS (shared hosting) claims template file malicious
- Cannot access wp admin of WordPress website (security plugin issue) [closed]
- PHP Code Sniffer – WordPress VIP Coding Standards
- How do I hide WordPress users from security scanning?
- Background Updates Not Happening
- wp-config.php file and code injection
- Problem with permissions in wp-content/plugins
- FORCE_SSL_ADMIN affecting subdomains
- What is the best security $_POST method?
- Is WordPress ready for GDPR compliance? [closed]
- Should WordPress Add Options to Enhance Security or Leave it to plugin developers? [closed]
- Directory to store secure file
- How can I give someone server access to only duplicate and modify a site?
- How can I implement ansible with per-host passwords, securely?
- Can you alter the default wordpress strong password requirements?
- how to sanitizing $_POST with the correct way?