The common SELinux security policy for webservers provides a set of types that can be used by normal users to tell SELinux how the webserver can operate on specified files. Users can use the chcon command to associate these types with specified files and directories.
Each of these types have specific properties, designed for specific purposes.
The httpd_user_script_exec_t type is a type that your webserver is allowed to execute. In addition there are rules associated with that type that instruct SELinux to run the script process with what is called "automatic process type transition" from the webservers process type to a process type specificly designed for common user cgi script processes. This type is associated with a specific set of permissions common to most cgi script processes.
The httpd_user_rw_content_t type is a type that your webserver is allowed to read and write. (example ~/public_content/myblog/wp_content)
The httpd_user_content_t type is a type that your webserver is allowed to read (example ~/public_content)
The httpd_user_content_ra_t type is a type that your webserver is allowed to read and append (example ~/public_content/myblog/logs)
These types can generally be useful when you toggle the httpd_enable_homedirs boolean to on. This boolean is associated with rules that allow your webserver to traverse $HOME so that it can for example reach ~/public_content.
Using the types and boolean above should ensure pretty decent integrity. For example your webserver will not be able to read your ~/.ssh or your ~/Documents, but will be able to read your website.
The user cgi script process will be contained as well, So that if it gets compromised , the damage it can do is contained to a reasonable extend.