some files are writable...

Which user is the owner of the files/directories?

A file with permissions 644 will be writable and readable by the owner (6), readable by the group (4), and readable by other users (4). If the owner is the user that your web server runs as, it will be able to write the files, and the Security Review check will fail. So I suspect a problem with your file/directory ownership.

The owner of the files/directories should probably be your user, and that user should be a different user than the web server user.

For example, suppose you are using the Apache web server and it runs as the user "apache". The owner of your Drupal files/directories could then be set to your user "foo": chown -R foo /path/to/drupal. Then you would be able to read/write files to maintain them, but the web server can only read them*.

* An exception is the web server user needs to be able to write files in the files directory, sites/default/files.

On Linux and other Unix-like systems each process runs as a user. You can list all current processes and which user they are running as using:
ps aux

Which user is Apache running as? (I assume from your previous comment that you are using Apache.) You can use this command to check:
ps aux | egrep '(apache|httpd)'

If the value for the USER column is 'laurent', that would confirm the problem. I could then give advice on how to fix it.

Hmm, that output does not seem to indicate which user the web server is running as.

Here is another way:
1. Create file whoami.php in your Drupal root directory with the following contents:

<?php echo `whoami`; ?>

2. Request your_site/whoami.php in a web browser. The username of the web server user will be given in the response.

I got ... laurent. again...

OK, that is probably the problem. The owner of the files/directories needs to be a different user than the user the web server is running as. If the web server user is the owner, the web server can write all files, which is dangerous. So either (1) the web server needs to not run as 'laurent', or (2) you need to create a new user and make it the owner.

Have you seen this page? It explains a lot about permissions/ownership.
https://www.drupal.org/node/244924

With GoDaddy are you using a VPS or shared hosting? What type of service do you have from them?

From the ps output it appears Apache is running as user 'nobody' on the VPS. If 'laurent' is the owner of the Drupal files, and the files/directories permissions are set properly, the Security Review check should pass.

What is the ownership and permissions for a file that fails the Security Review check (ls -la output)?

Maybe it is possible to create an FTP user, then upload your Drupal files using that user, so that they are owned by that user instead of the web server user ('laurent')?
https://support.godaddy.com/help/article/1236/adding-ftp-users-to-your-s...

It might just not be possible to solve this problem with a GoDaddy shared hosting account, as you say. (Unfortunately they do not offer a free trial, else I would try.) GoDaddy does offer dedicated servers and VPS accounts, which would allow creating users, if that is an option.

I am having the exactly the same problem, although i am on a dedicated server, so may be easier to sort.

so all my files are listed as having bad permissions issues, even thugh they are 0755 directories and 0644 files, like original post, plus the server is able to edit /httpdocs/sites/all/modules/security_review/IGNOREME.txt, even though it is 0644.

looks like an ownership issue again

my hosting company arent able to assist as they say all permissions are fine

i hope you can help.

to top it off, all my drupal installations i are currently being hacked, even though they have been updated to 7.58, etc, constantly having to delete files etc, change permissions.

permissions issues are the only thing being flagged in security review, so would be good to get this sorted

i have just run ps aux | egrep' '(apache|httpd) command and output is:

Last login: Mon Apr 23 12:18:40 2018 from 193.200.80.2
root@server3:~# ps aux | egrep '(apache|httpd)'
root 1742 0.0 0.0 9452 920 pts/2 S+ 16:14 0:00 egrep --color=auto (apache|httpd)
root 8426 0.0 0.1 475096 44496 ? Ss 10:26 0:00 /usr/sbin/apache2 -k start
www-data 8429 0.0 0.0 182576 21068 ? S 10:26 0:05 /usr/sbin/apache2 -k start
www-data 8431 0.0 0.3 483284 90276 ? S 10:26 0:17 /usr/sbin/apache2 -k start
www-data 8434 0.0 0.4 508612 117424 ? S 10:26 0:15 /usr/sbin/apache2 -k start
www-data 8435 0.0 0.4 508316 115700 ? S 10:26 0:17 /usr/sbin/apache2 -k start
www-data 8746 0.0 0.4 491576 98396 ? S 10:29 0:17 /usr/sbin/apache2 -k start
www-data 13383 0.0 0.4 508308 115380 ? S 11:34 0:14 /usr/sbin/apache2 -k start
www-data 18369 0.0 0.3 483772 89860 ? S 12:42 0:09 /usr/sbin/apache2 -k start
www-data 18888 0.0 0.4 495220 102980 ? S 12:49 0:09 /usr/sbin/apache2 -k start
www-data 20222 0.0 0.1 475628 31292 ? S 16:00 0:00 /usr/sbin/apache2 -k start
www-data 29006 0.0 0.2 480988 69096 ? S 14:59 0:03 /usr/sbin/apache2 -k start
www-data 29041 0.0 0.3 498788 88768 ? S 14:59 0:03 /usr/sbin/apache2 -k start
root@server3:~#

can you see which user the web server is running as?

help appreciated

matt

attached is an example of a file that is being flagged as having incorrect permissions and you can see what the permissions are

Just to clarify, this is for Drupal 7.58, security review 7.x-1.3

Closing as outdated after 6 years as we transition to Drupal 10.

I'm keeping an eye on the 7.x branch of this module, reviews and majors, but
active work is going toward 2.x (supporting D10)

If valid for 2.x please reopen