>That still leaves the wp-content directory and everything in it, including other plugins, writable by the web server. You don't have to have the wp-content di

>That still leaves the wp-content directory and everything in it, including other plugins, writable by the web server. You don't have to have the wp-content directory writable by the web server. I certainly don't on the WordPress installs that I maintain. I also do not have FTP open and listening. Users can SSH/SFTP files up if they wish, but I don't let the web server write into the Wordpress area for specifically that reason.