My current host has it set up so that Apache runs as the same account that I use to manipulate files on the file system and, subsequently, the same user that I used to install Drupal 7.
I'm trying to pass the checks in the Security Review module, but it keeps complaining that (pretty much all) files and directories are accessible. I've looked at the handbook page and tried applying the script, but to no success.
Can anyone suggest the proper permissions for my files and directories?
If you're on a shared host this is to be expected, a lot of them operate like that.
Most use suEXEC as the Apache PHP handler which is what makes the web user have full read/write rights over the whole document root. Unless you have access to change the Apache PHP handler (or at least its settings) I doubt you'll be able to change this yourself.
Your hosting provider might do it for you if you get in touch with them, but going on past experience they're normally reluctant to change this sort of thing (in the case of a shared server they might not even be able to do it on a site-by-site basis).
