I know this is an old thread but I'm trying to figure out the best way to set things up.
History: I got a VPS on Sunday... I'm hosting my clients, a site from a previous client who is now managing things inhouse, and possible a few other sites for some friends. In short I know the people using the server personally...
I followed the KnownHost Knowledge base instructions on PHP Security (Turn on safe_mode, Disable Dangerous PHP Functions, Turn off Register Globals, Run PHP through PHPsuexec) but now am not sure that was the best thing to do... for one it was apparently written in 2006...
There are currently 3 WordPress sites, some php to send contact forms to an email, and some pages using php includes to pull in header, sidebar and footer pages.
I'm quite overwelmed with all of this as it came about very suddenly when I asked the previous host if he could upgrade to php5 and was told he was going to shut down his business...
777 is the access mode which allows to read, write and execute for file/directory owner, group owner and any other system user. Having such permissions isn't a security problem as long as you're running secure scripts on your sites as in order to be able to write some file to the system remote party has to find an insecure script on your site which would allow them to upload / execute their own code on your system.
Think about this way - when enabling PHP to be running through SuPHP if there is an insecure script on your site the person who will exploit it will be able to create/execute files in any directory inside your account's home directory as all your files/directories are owned by the account's system user and are readable / writable / executable by the account's username.
In other words - when you have a VPS (or dedicated) and you're the only user on that system switching from mod_php to SuPHP won't only make your PHP based sites run slower but will also decrease your level of security.