Case: One chmod Sweep Found 1,847 World-Writable Files

Case: One chmod Sweep Found 1,847 World-Writable Files
Inherited a hosting account after a malware cleanup. A previous "fix" had set huge swaths of files to 0777.

Audit SOP:

— Step 1: Inventory the damage. find . -type f -perm -0002 | wc -l returned 1,847 world-writable files.
— Step 2: Inventory dirs. find . -type d -perm -0002 | wc -l returned 213.
— Step 3: Reset files to 644. find . -type f -exec chmod 644 {} +
— Step 4: Reset dirs to 755. find . -type d -exec chmod 755 {} +
— Step 5: Lock config. chmod 600 wp-config.php
— Step 6: Re-scan with step 1 — expect 0.

Outcome: 1,847 → 0 world-writable files. Two reinfection attempts in the next week both failed to write payloads.

Run this every time.