I just noticed that the /web folders of sites on my server have some different permissions, some are mode 755, some 751, some 775, and most are either 711 or 750. I don't know the differences in how they were all created (php enabled or not, suexec enabled or not, etc.), but it was all via the ui at different times (this server is maybe 2-3 years old?). I propose they are always set mode 750 if suexec is enabled, and ... maybe 751(?) if suexec is disabled (not positive on that from memory). I'm probably overlooking some cases, so tossing this out for discussion.