I have my clients wordpress sites hosted as follows:<p>$Owner (owns directory, has rwx)
$Owner-cgi (in group of $Owner, which has r-x, and only rwx in uploads)
Everyone (can read files in upload, but cannot even read wp-config.php, or other similar files).<p>nginx runs as nobody, and so can read the static files, uploads, etc. But if nginx is hacked, it still can't read database configuration, etc.<p>Each $Owner-cgi user is what php-fpm (or HHVM, probably in the future) runs as. logged in users can upload new media content, but cannot install new plugins, edit php files, etc.<p>To upload new plugins, wordpress has a pretty cool 'use ftp' feature, which lets logged in users type in a ftp user on the server, which lets them install new plugins. The username/password they use is the $Owner one. The FTP daemon only allows localhost access, and the $Owner user doesn't have shell access.<p>nginx is set up to block a whole bunch of standard things (such as any request with wp-config in it...)<p>This setup automatically blocks most of the exploits that are around, and is pretty easy to use. It also means that even if a plugin does get exploited, there's very little that can be done, without knowing the FTP username & password (which is long, and random).<p>All of this enforced and configured by ansible. Setting up a new client site takes about 2 minutes. (Answer a few questions from my 'make a new client' script, and then run the ansible site.yml)