It depends on the ownership of the file/directory. Just remember, PHP under suPHP will access PHP scripts as the owner user, and those PHP scripts will operate as that user, meaning, everything they read or write is done as that user. So, PHP scripts only need to be owner-readable to run.
However, anything else not being a PHP script is accessed as the Apache user (they are not accessed by suPHP), meaning that user need at least read access to the files and read+execute access to directories. If those files are owned by a common user, they will need to be world-readable (and world-executable for directories). But if they are owned by the web server user (nobody, www-data, apache, depending on distro) they only need to be owner-readable/owner-executable.
A note for directories: Apache (when serving non-PHP files) will try to read every directory in the path searching for .htaccess files, if it cannot explore the directories, it will fail with a 403 error, even if the file is readable.
So, I think for most websites or web applications all files (PHP files and non-PHP files, and directories) would be owned by a single user, so the permissions would be:
- PHP scripts: 0400 (u+r), or 0600 (u+rw) if PHP need to modify them.
- non-PHP files: 0444 (ugo+r), or 0644 (u+rw,go+r) if PHP need to modify them.
- directories: 0555 (ugo+rx), or 0755 (u+rwx,go+rx) if PHP need to create files in them.
Another note: even if you set 0400 for a PHP script, it can be modified by another PHP script owned by the same user, as it can simply run chmod from PHP, so a 0400 is not safer than 0644. This apply only when using suPHP.