what permissions should my 'normal' users have to access my website?

Question

Recently I was subject to a hack by "HACKED BY SyRSyR!4N M43STR0". Thankfully, no real damage.

I am trying to figure out how they got in and was checking my permissions on some of my folders. I'm not sure I understand what user gives the public user visiting the site access to the website.

Here is some examples:

1. Should any user have write capabilities on the folders that are in my site?
2. How about execute capabilities?
3. Lastly, who is the 'public' user that when the user visits the site that gives them access? <-- this is one of my main questions

Thanks!

===== EDIT #1 =====

I have some sites that do not have an app pool account on them such as:

How is the user able to access the site with no app pool account access? Is the app pool the default user account? Also, should I add the account manually?

Answer 1

The app pool account only need read access to the files and folders. Your admins domain accounts (or machine accounts) will need write access, but the site doesn't. The only exception to that would be if the website needs the ability to upload files to the site, in which case the app pool would need write access to the folder that the site will be uploading to.