What is the “user account” for WordPress’ file permissions?

»your user account« describes the system user of the remote host. Depending on the environment of your hosting provider, this is typically the same as the basic FTP account. In fact, it’s a user on an operating system. So yes, you should be able to change it via FTP.

As there are typically many users working on one remote host, it’s important to set the file permissions correctly. Rule of thumb: no one than you (your account) should have write permissions to any file or directory. Read-permissions should be granted to everyone, except for files with sensitive data (e.g. log files, database dumbs, all these could go with 600).

Why should everyone able to read files?

Assuming your provider configured apache as web server, the apache process runs under a separate system user (typically www-data). That means, to serve your content (attachments) to the world, the user www-data needs reading-permissions on these files. As your account and www-data normally doesn’t share your default group, this means reading permissions to everyone (xx6, xx4).

And PHP files?

This depends on the PHP setup of your provider. If they configured PHP running in fast-CGI mode, the PHP interpreter runs normally with the privileges of your account. That means in theory, you could remove read-permissions of every php-file to anyone than you (600). But except for wp-config.php this doesn’t really has any »hardening« benefit.

What is about wp-config/uploads?

If PHP runs in fCGI mode, default directory permissions (755) should totally be fine. If PHP runs as apache-module, it depends on the user/group management of your provider whether you need 775 or (in worst case) 777 for wp-content/uploads. If in doubt you should contact your provider and ask for the correct permissions.

Some words about these permissions:

File system permissions are handled with three classes: user, group and others and three independent permissions: execute, write and read.

Each file (or directory) is assigned to one user and one group. Here’s an example:

$ ls -la wp-config.php
-rw-rw-r-- 1 david worker 1845 Jan 18 19:01 wp-config.php

This file wp-config.php belongs to the user david and the group worker. The symbolic notation of the files permission are read as:

  • user: rw (read & write) → 6
  • group: rw (read & write) → 6
  • others: r (read) → 4

In numeric notation that combines to 664. That means, user david is allowed to read and write the file, as he is the »owner« of the file. Any user which is in the group worker is also allowed to write to the file, as this is the group of the file. Anyone else (any user which is not david or in the group worker) is allowed to only read the file.

Some reference about file permissions: https://en.wikipedia.org/wiki/File_system_permissions