A follow up to a previous question found here [How can I lock down an old wordpress install I don't intend to update?](https://wordpress.stackexchange.com/questions/6109/how-can-i-lock-down-an-old-wordpress-install-i-dont-intend-to-update)

Same info still stands. WordPress install will (probably) not be updated. Never ending caching has been enabled. Database can only be read.

I thought my WordPress installation was pretty well locked down, however it seems that at some point, something was able to create a file in the theme directory of a funny looking nature (ending in eval(blah)).

I wouldn't class myself as a sysadmin type of guy, but I'm thinking that someone would know what directories I should set with particular permissions to harden my security.

Can anyone help on this?

Thanks in advance