Fix & secure WordPress files & permissions

wp-fix-permissions.sh

chown -R www-data:www-data .
find . -type d -exec chmod 755 {} \;
find . -type f -exec chmod 644 {} \;
#find . -type f -name ".htaccess" chmod 640 {} \; # If you're not using Pretty URLs (permalinks), use 604 < 640 permissions.
find . -type f -name "wp-config.php" chmod 440 {} \;

WordPress official post Changing File Permissions suggests securing wp-config.php with 440 permission and .htaccess between 604 < 644 permission.

If you're using Pretty Permalinks (URLs), it is suggested to use 666 😈 permission.

[UPDATE]
If you're using plugin that rewrites .htaccess or wp-config.php files (for example, LiteSpeed Cache), you should leave at least 6** permissions, otherwise you'll have to update these files manually.