Evaluations of two wordpress security plans against php code injection attack

Question

Senario:

I've posted one wordpress php code injection senario on SO before, url:https://stackoverflow.com/questions/26826082/what-is-the-highly-efficient-way-to-remove-a-block-of-string-pattern-in-php-file

I found it happens regularly in some of the wordpress site, the consequence is it caused plugin crash, or unable to login /wp-admin untill u've removed all the injection patterns from all php files as using the time consuming method I mentioned in the above post, however till now i do not know where the flaw is for attacker to inject such code in wordpress.

Nevertheless, after researching besides regularly clean files backup. I've got below wordpress security plans to avoid injections :

Solution 1. wordpress update plan

        meaning always check out updates wordpress to latest version
        always check out updates making sure plugins to latest version.

Solution 2. strict file/folder permission config on wordpress [php,normal files,folders]

        never allow php file updates on production site, 
        apache chmod set 
        all wordpress *.php files to chmod 644; 
        all normal files  *.js *.css *.html etc to 755; 
        wp-upload folder set chmod to 755
        rest wordpress folder set chmod to 644; 

For these two approches,

Solution1: (focus on update to latest version counting on latest patches'll fix vulnerabilities while leaving chmod as default permission when wordpress/plugin is installed. )

actually is very labor consuming cause there are so many updates to take care of and u never know whether cetain plugin update will cause compatibility issue with the wordpress version. and I don't think it can cover everything to prevent injection in my SO post. furthermore,if site already got injected and u didn't relize before you go any update process, it will usually cause plugin crash as I've been through many times before. But updating plan is the most popular method to reinforce wordpress security but requires human monitoring and maintenance during the updates.

Solution2:(focus on customizing chmod permissions to disallow file changes) Here is a reference link of codex on wordpress chmod setting: http://codex.wordpress.org/Changing_File_Permissions

looks reasonable but will definitely have to test if chmod overprotection cause incompatibilities with the working plugins, etc. As certain plugins requires insecure permissions to work. It also means little changes can be made to production site as per the permission configuration.

So guys, which approach would u suggest to secure the wordpress php files from being injected. any comments on the above two solutions.

Or any better plans to fight against such kind of code injections?

( solutions with less human monitoring involvment are preferred.)

Answer 1

First, both of these things (updates and sane file permissions) are neither "OR" choice or optional. That is what you just do, because if you don't sooner or later (even if significantly later) you are going to have problems because of it. Relatively I would say updates are more important, because faulty file permissions tend to harm when in already compromised environment (like poorly configured shared hosting).

Second, if you repeatedly experience infection of your site(s) then neither of the two would do anything for you. You have serious hole somewhere, either easily detected to be exploited by automated scanners or someone knows and keeps exploiting manually. Before you determine what that hole is and how to close it any other security measures are pretty much moot.