i second this (but also as a learner not a guru) i admin a server where nothing is writable by the user the webserver runs as except manually modified items/folders where the cms is expecting to upload images or pdfs etc. The hand-changed folders are non-executable by php . I'm sure there is a smarter solution but since implementing this we haven't had a successful malware/deface incident .