Another question on Drupal files folder permissions and security
Why have 755 on sites/default/files directory (and sub-directories) instead of 744? Isn't the files folder by definition for user files and system caching files? To flip the question around, is there any legitimate reason to allow "x" for the group/other users?


Without the "x" being set for a directory, the group/user will not be able to look inside the directory.  So you usually want the "x" bit set for group/users for the directory in order to be able to examine these in the CLI without being root.


  Is the new default .htaccess file (shown below for reference) that gets written to sites/default/files "secure enough" that even if a user hacks the front end or database, they can't really cause much havoc? 


IMHO, the Drupal .htaccess is adequate for preventing executables downloaded to the upload from being executed.

However, having this file in place does not protect you from front-end or database exploits. And attackers gaining access to execute PHP from the database can remove or replace it.

So you also want to prevent PHP injected into the datebase from being executed. You do this by removing the core PHP module. Do this:

rm -rf modules/php/


You should never enable this misfeature (it has been removed from core in D8), but by physically removing out, you eliminate the risk of somebody making a succesful SQL injection exploit also being able to execute PHP.

Provided you don't use it (and you shouldn't), and it is already disabled, removing it has no side-effects.