CiviCRM in WordPress on NGINX file permissions

[phoebe]

Hi,

I have just successfully installed CiviCRM on Wordpress and I received a message saying that CiviCRM was able to access my upload directory through HTTP and that this is bad.  However, I can't find much info about what the file permissions should look like.  The message said that CiviCRM would need local file access to  the upload directory but I am not sure how to provide that while restricting HTTP access (short of firewall rules...).  The current permissions and user/group on the upload directory are:

rwxr-xr-x www-data:www-data

After navigating away from CiviCRM in Wordpress and then coming back the error message has gone but I tested access to the upload directory and I am able to access data there through a web browser.  Any info would be helpful.  I have enough knowledge of permissions to be dangerous but not heaps of knowledge about the finer details.