Hi
I was wondering if anyone had some tips on best practice security modifications to make to a SMF install ?
eg. recommended .htaccess changes, etc etc.
Once you've installed any themes / mods I'd recommend you make everything read-only (chmod 666) except for the attachments folder :)
Read-only is 444, actually.
Think I actually meant 555 (read+execute).
That would work fine as well, but I recommend not setting execute on files. If the host has Apache's XBit Hack (http://httpd.apache.org/docs/1.3/mod/mod_include.html#xbithack) enabled, there is a slight chance of a possible security issue.
Execute on directories is required, as having that set means you can go into them.
Simplest option is to use the feature built into the package manager.
Admin > Packages > Options > Cleanup Permissions > Change all file permissions throughout the forum such that: The minimum files are writable.