Spooky Wordpress plugin Wordfence scan telling whole disk space

Most standard system binaries like /bin/df are 755 permissions, so most users (including the usernames which execute apache and PHP) can run them. This is pretty normal.

You could try restricting some of the more risky php functions by using the disable_functions setting in /usr/local/lib/php.ini. This can make it harder for php scripts to use system utilities. Mine is currently set to this:

disable_functions = show_source,system,shell_exec,passthru,exec,phpinfo,popen,proc_open,allow_url_fopen

Keep in mind this does not take into account that on most systems users can just set their own php.ini settings anyway, but there are other threads about stopping that ability.