Up until now I've been "protecting" my website's PHP files by making them read-only with
Is this a useful security tactic? Or is it some "old wive's tale" and I'm wasting my time?
I'm inclined to think that anyone who is in a position to modify my PHP files could also
chmod them (thus barely slowing down any would-be attacker). Or they could just create a new file somewhere (like a cache or upload directory). Thoughts?
The downside of implementing this technique is that I have to shell in and make the files writable every time I want to automatically update WordPress (or, really, make any changes to my site). So I update less often than I probably should. So, even if it's marginally useful, is it worth it?