I have my clients wordpress sites hosted as follows: $Owner (owns directory, has rwx) $Owner-cgi (in group of $Owner, which has r-x, and only rwx in uploads) E

I have my clients wordpress sites hosted as follows: $Owner (owns directory, has rwx) $Owner-cgi (in group of $Owner, which has r-x, and only rwx in uploads) Everyone (can read files in upload, but cannot even read wp-config.php, or other similar files). nginx runs as nobody, and so can read the static files, uploads, etc. But if nginx is hacked, it still can't read database configuration, etc. Each $Owner-cgi user is what php-fpm (or HHVM, probably in the future) runs as. logged in users can upload new media content, but cannot install new plugins, edit php files, etc. To upload new plugins, wordpress has a pretty cool 'use ftp' feature, which lets logged in users type in a ftp user on the server, which lets them install new plugins. The username/password they use is the $Owner one. The FTP daemon only allows localhost access, and the $Owner user doesn't have shell access. nginx is set up to block a whole bunch of standard things (such as any request with wp-config in it...) This setup automatically blocks most of the exploits that are around, and is pretty easy to use. It also means that even if a plugin does get exploited, there's very little that can be done, without knowing the FTP username & password (which is long, and random). All of this enforced and configured by ansible. Setting up a new client site takes about 2 minutes. (Answer a few questions from my 'make a new client' script, and then run the ansible site.yml)