Minimally, you want your webserver to be able to write to the files in your data directory (files_dir) and your “public” and “cache” directories, and you want to deny the ability to write to everything else. If you want to be able to add, remove, and update plugins over the web, you will also need your “plugins” directory to be writable.