As discussed, it’s important to protect your site by setting proper file permissions on the server. This can be tricky for certain directories such as /uploads/, /upgrade/, and /backups/, which need to be writable by the server in order for things like uploads, upgrades, and backups to work.

When cleaning up hacked sites and testing .htaccess tricks, it’s nice to have a list of WordPress directory and file names for checking patterns and finding strings directly via Search/Find. Especially when working remotely, having a complete list of WordPress files available online can help expedite the attack-recovery process.