“Some files and directories in your install are writable by the server.”

Question

I’m running a Drupal 8.5.3 site and the module: Security Review. One od the “red” results was: Some files and directories in your install are writable by the server.

Details:
“It is dangerous to allow the web server to write to files inside the document root of your server. Doing so could allow Drupal to write files that could then be executed. An attacker might use such a vulnerability to take control of your site. An exception is the Drupal files, private files, and temporary directories which Drupal needs permission to write to in order to provide features like file attachments.
In addition to inspecting existing directories, this test attempts to create and write to your file system. Look in your security_review module directory on the server for files named file_write_test.YYYYMMDDHHMMSS and for a file called IGNOREME.txt which gets a timestamp appended to it if it is writeable.
Read more about file system permissions in the handbooks.
The following files and directories appear to be writeable by your web server. In most cases you can fix this by simply altering the file permissions or ownership. If you have command-line access to your host try running "chmod 644 [file path]" where [file path] is one of the following paths (relative to your webroot). For more information consult the Drupal.org handbooks on file permissions.”
(long list of files, including those of /core, /modules, /themes, etc)

Nevertheless if I set the permissions of the core directory to 644 the site does not work. How can I solve this reported warning?

Answer 1

6/4/4 means read+write/read/read - this is OK for files but not for directories. Directories must be executeable, so set them to something like 755 (read+write+execute / read+execute / read+execute).