I'm trying to figure the right security settings for the files on my shared webserver and I have a few basic questions that I've not figured out by looking around.
How do I stop people reading my PHP files. The recommended setting seems to be 644 which allows the whole world to read them. Is that right? Does the php suffix stop them?
If PHP script (executed by the client) within public_html is accessing a html file on the same server but above public_html, can I set that to 600 in that the script is effectively the user?
Is anything above public_html is hidden from the outside or is it just the permissions that do that?
Edit By client, I mean an iPhone app which calls a variety of PHP scripts. The content of the files is not super private - but I want to minimise the risk of hacking and so don't want people to easily be able to read scripts and other files.