<b>File Permission Audit SOP</b>

<b>File Permission Audit SOP</b>
Run on any server you inherit or after a suspected breach.

— Step 1: Directories to 755, files to 644. Run <code>find . -type d -exec chmod 755 {} \;</code> then <code>find . -type f -exec chmod 644 {} \;</code>.
— Step 2: Lock <code>wp-config.php</code> to 640 (or 600 if PHP runs as owner). Never 644 on shared hosting.
— Step 3: Verify ownership. Web files owned by the app user, never <code>root</code> and never the web server user as owner.
— Step 4: Hunt for 777. <code>find . -perm -o+w -type f</code> — anything world-writable is a backdoor waiting to happen.
— Step 5: Confirm <code>uploads/</code> can't execute PHP. Add a deny rule for <code>.php</code> in that directory.

Run this every time.