Gyp
I don't think it means that your settings are off but if something does
happen, I don't know whether having FS_METHOD set to direct won't cause a
problem. FTP is only used to copy date internally from the download
temporary location to where it is needed with the correct user and group. So
you can firewall it off to all IPs except the actual IP of the server (and
localhost to be complete). Unless you want your users to be able to FTP in
then I assume chroot is in action...:-)
This should be OK for plugins and themes, which need to be under wp-content
and the web server may need write access to create directories etc. But a
core upgrade might present a problem. I haven't tried this.
Interested that you are using nginx - I use it as a reverse proxy in front of
Apache and it seems to work OK with a module, mod_rpaf and a plugin. This
means that .htaccess still works - maybe some day someone will write a
restricted .htaccess parser for nginx (you only really need to check the root
directory after all, not the whole b****y tree!).
--
Best wishes
John Logsdon